Rate limits

Each API key can make about 100 requests per minute. The quota is counted by each server that answers the API, so the exact number of requests accepted in a given minute can vary slightly: treat 100 per minute as a budget to stay under, and always handle a 429. Every response — including 401 and 403 — carries these headers (only a 503 service_unavailable may come without them):

Header	Meaning
`X-RateLimit-Limit`	Requests allowed per window, for this key
`X-RateLimit-Remaining`	Requests left in the current window
`X-RateLimit-Reset`	Seconds until the window resets — not a timestamp

When you’re over the limit

A 429 response adds a Retry-After header (seconds to wait) and the standard error body:

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded — retry in a few seconds",
    "details": {
      "retry_after_seconds": 42
    }
  }
}

Backing off

response=$(curl -s -w "\n%{http_code}" "https://core-api.agentova.ai/v1/automations?limit=1" \
  -H "Authorization: Bearer agk_live_your_key_here")
http_status=$(printf '%s' "$response" | tail -n 1)
body=$(printf '%s' "$response" | sed '$d')

if [ "$http_status" = "429" ]; then
  retry_after=$(printf '%s' "$body" | jq -r '.error.details.retry_after_seconds')
  sleep "$retry_after"
  # ...then send the request again
fi

Reading X-RateLimit-Remaining on every response and slowing down before you hit 0 is friendlier than waiting for a 429 — and every response gives you that number for free.

Failed authentications

After more than 30 failed authentications in a minute from the same IP address, further requests from that address with a missing or invalid key get 429 instead of 401. A request with a valid key is never refused by this limit, so tools that share outgoing addresses, like Zapier, aren’t penalized by someone else’s mistakes.

Getting Started

Guides

Help

Updates

When you’re over the limit

Backing off

Failed authentications

​When you’re over the limit

​Backing off

​Failed authentications

When you’re over the limit

Backing off

Failed authentications