Rate & Connection Limits

The gateway budgets your traffic with a token-bucket limiter, plus a per-IP request limit and WebSocket connection and subscription caps. Limits are tiered to support both general programmatic use and high-throughput market-making.

The budget is weight per second, not requests per second. Most requests cost one unit, heavy aggregate and history reads cost five, and a batch submit scales with its size — so a Pro caller at 20/s gets 20 ticker reads per second but only 4 /fills reads. The full model, including the three independent budgets, the response headers, and the current per-tier ceilings, is documented once in Rate Limits under Interfaces. Read that page before building a client-side limiter; the per-operation costs are normative in the OpenAPI spec at /openapi.json.

When you exceed a limit the gateway returns HTTP 429 with retry-after. x-ratelimit-limit and x-ratelimit-remaining accompany every authenticated response so you can pace without tripping the limiter; x-ratelimit-reset and retry-after appear on the 429 only.

Other limits

Limit	Value
HMAC timestamp window	±30s of server time
WebSocket token lifetime	60s, single-use
Session token lifetime	24h
Faucet (/account/credit)	500 USDX/day per key (testnet)

Status: testnet preview. Tier ceilings are current configuration and may change as the tier system is finalized across release gates. Rate-limit state is currently in-memory at the gateway and resets on restart.