API / Getting started
Rate limits
300 requests a minute per user, 100,000 a day per organisation, and how to handle a 429.
The Light API enforces rate limits to ensure fair usage and maintain performance for everyone. Exceed one and you get a 429 Too Many Requests response.
Rate limit structure
Two limits apply by default. Light can agree different limits with your company.
Requests per minute
- 300 requests per minute per user.
- Every API key and OAuth token belonging to one user draws on that same allowance, so adding keys does not add capacity.
Daily limit
- 100,000 requests per day per organisation.
- Shared across all users in your organisation.
- Resets at midnight UTC.
Handling rate limit errors
A 429 Too Many Requests response carries these headers:
| Header | Meaning |
|---|---|
X-RateLimit-Limit |
Maximum capacity (e.g. 300 for the per-minute limit) |
X-RateLimit-Remaining |
Remaining capacity |
X-RateLimit-Reset |
Unix timestamp when the limit returns to full capacity |
Retry-After |
Recommended seconds to wait before retrying |
Best practices
- Monitor the headers. Check
X-RateLimit-Remainingbefore a large batch of requests. - Implement exponential backoff. Wait progressively longer between retries — 1s, 2s, 4s, 8s.
- Respect
Retry-After. Always wait at least that long before retrying. - Spread out scheduled jobs. Avoid running every batch operation at the same time.
Need higher limits?
If your use case requires higher rate limits, contact Light support at help@light.inc to discuss custom limits for your organisation.