> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentova.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> Every response carries your quota — even the ones that reject your request

Each API key can make about **100 requests per minute**. The quota is counted by each server that answers the API, so the exact number of requests accepted in a given minute can vary slightly: treat 100 per minute as a budget to stay under, and always handle a `429`.

Every response — including `401` and `403` — carries these headers (only a `503 service_unavailable` may come without them):

| Header | Meaning |
| - | - |
| `X-RateLimit-Limit` | Requests allowed per window, for this key |
| `X-RateLimit-Remaining` | Requests left in the current window |
| `X-RateLimit-Reset` | Seconds until the window resets — **not** a timestamp |

## When you're over the limit

A `429` response adds a `Retry-After` header (seconds to wait) and the standard error body:

```json theme={null}
{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded — retry in a few seconds",
    "details": {
      "retry_after_seconds": 42
    }
  }
}
```

## Backing off

```bash theme={null}
response=$(curl -s -w "\n%{http_code}" "https://core-api.agentova.ai/v1/automations?limit=1" \
  -H "Authorization: Bearer agk_live_your_key_here")
http_status=$(printf '%s' "$response" | tail -n 1)
body=$(printf '%s' "$response" | sed '$d')

if [ "$http_status" = "429" ]; then
  retry_after=$(printf '%s' "$body" | jq -r '.error.details.retry_after_seconds')
  sleep "$retry_after"
  # ...then send the request again
fi
```

Reading `X-RateLimit-Remaining` on every response and slowing down before you hit `0` is friendlier than waiting for a `429` — and every response gives you that number for free.

## Failed authentications

After more than **30 failed authentications in a minute from the same IP address**, further requests from that address with a missing or invalid key get `429` instead of `401`. A request with a valid key is never refused by this limit, so tools that share outgoing addresses, like Zapier, aren't penalized by someone else's mistakes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.