Rate Limiting

Overview

To provide a reliable and consistent experience for all users, we have implemented rate limiting on the /oauth/token endpoint. This means there are limits on how many authentication requests can be made within a specific timeframe.

OAuth Token Endpoint

/oauth/token Rate Limits

• Rate Limit: 180 requests per minute per clientId and userId

Error Response

If this limit is exceeded, the API will return an error with the message:

{
    "errorCode": "AUTHENTICATION FAILED",
    "message": "Too many requests, please try again after [X] seconds."
}

General API Rate Limits

The following rate limits are applied based on the environment. The "burst" limit is intentionally set higher to handle legitimate spikes in traffic without impacting your service.

Sandbox Environment

Authenticated Traffic (per Member ID)

Unauthenticated Traffic (per IP Address)

Production Environment

Authenticated Traffic (per Member ID)

Unauthenticated Traffic (per IP Address)