Start hereGuide
Keys, limits, and quotas
Create, rotate, and revoke keys, and understand the limits attached to them.
By the end: You can manage keys and predict when a request will be throttled.
Keys are per account, and limits apply on several levels at once. Knowing the levels explains most 429s.
| Field | Value | Notes |
|---|---|---|
| Requests per minute | Per key and per account | Both must pass. A single key cannot use the whole account allowance. |
| Concurrent requests | Per account | Held for the life of the request, including streams. |
| Daily requests | Optional, per account | Set by an administrator. Returns quota_exceeded. |
| Monthly tokens | Optional, per account | Counts input plus output for the calendar month (UTC). |
Reading the headers
Successful responses include x-ratelimit-limit-requests and x-ratelimit-remaining-requests for your account limit. A 429 carries retry-after in seconds.
Practical advice
- Give each application its own key so one can be revoked without breaking the others.
- Close streams you no longer need. An open stream holds a concurrency slot.
- Back off for at least retry-after, and add jitter so retries do not synchronise.
Never put an API key in browser code, a public repository, or a client-side bundle. Keys are server-side secrets; a leaked key can spend your balance.