HTTP
HTTP 429Too Many Requests
HTTP 429 Too Many Requests means the client has sent more requests than the server allows in a given time window and is being rate-limited. The response may include a Retry-After header saying how long to wait. Clients should back off and retry later rather than hammering the endpoint.
What 429 means
The server counts requests per client (by API key, token, IP address or account) and this client has exceeded its quota for the window. The request was not processed. The server may explain the limit in the body and in headers such as Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (an epoch timestamp; the timestamp converter reads it).
Typical limit designs
| Design | Behaviour |
|---|---|
| Fixed window | N requests per minute; resets on the minute |
| Sliding window | N requests in any 60-second span |
| Token bucket | Requests consume tokens that refill at a steady rate; allows short bursts |
| Concurrency limit | At most N in-flight requests |
Handling 429 in code
- Read
Retry-After. Sleep that long. - If absent, use exponential backoff with jitter: 1 s, 2 s, 4 s, 8 s… plus a random fraction.
- Cap retries; after several failures, surface the error.
- Reduce the request rate at the source: batch calls, cache responses, avoid polling.
curl -i https://api.example.com/itemsLook for 429 and the rate-limit headers in the output.
Avoiding it
- Respect documented limits; most APIs publish them.
- Use webhooks or streaming instead of polling.
- Identify your client honestly with a descriptive User-Agent; anonymous scrapers get the tightest limits.
- Spread scheduled jobs so they do not all fire at the top of the hour.
Frequently asked questions
How long should I wait after a 429?
As long as Retry-After says. If absent, start with a few seconds and double the wait on each consecutive 429, with some random jitter, up to a sensible maximum.
Why am I rate-limited as a normal user?
Shared IP addresses (offices, mobile carriers, VPNs) can hit limits collectively; browser extensions or open tabs may poll an API; or the site applies aggressive bot heuristics. Waiting usually resolves it.