Rate limits

Rate limits are enforced per customer account (falling back to IP for unauthenticated endpoints), on a rolling 1-minute window unless noted otherwise.

Endpoint group	Limit	Notes
POST /v1/messages/send	1,000 requests / minute	Per account. Use bulk for higher throughput.
POST /v1/messages/bulk	100 requests / minute	Each request may contain up to 10,000 messages.
POST /v1/auth/login	20 attempts / 15 minutes	Brute-force protection.
Most other authenticated endpoints	500 requests / minute	Dashboard and general API traffic.
Public, unauthenticated endpoints (e.g. push registration)	120 requests / minute per IP	No API key or login required on these.

Handling a 429

A rate-limited request returns 429 with limit, window and retry_after (seconds) in the body, plus standard RateLimit-* response headers. Back off for at least retry_after seconds before retrying — don't retry immediately in a tight loop.

{
  "error": "Rate limit exceeded",
  "message": "You can send up to 1,000 messages per minute. Please slow down or use the bulk endpoint.",
  "limit": 1000,
  "window": "1 minute",
  "retry_after": 12
}

Sending more than 1,000 messages a minute

Use POST /v1/messages/bulk instead of looping individual /send calls — it's rate-limited per request (100/min), not per message, and each request can carry up to 10,000 messages.