Rate Limits and Security

Every API key has a rate-limit policy: a request limit and a time window, 5,000 requests per hour by default. Once a key is authenticated, every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers, mirrored in meta.rateLimit in the response body.

A 429 response additionally carries a Retry-After header, in seconds, and the message "Rate limit exceeded. Retry after <n> seconds." To raise or lower a key's limit, contact solarOS support; there is no setting for it in Settings today.

Grant only the scopes an integration needs, rotate keys on a schedule, and keep long-lived keys out of browser code and public repositories.