Rate limits

Each key may make 100 requests a second. The count starts after the signature is checked, so an unsigned flood does not use up your limit, and each key has its own.

Over the limit the answer is:

HTTP/1.1 429 Too Many Requests
Retry-After: 1
Content-Type: application/json

{"status":429,"code":"rate_limited"}

Nothing was done. Wait Retry-After seconds and send the request again — with a new signature and the same Idempotency-Key.

To stay under it:

• Use webhooks, not polling. Read a payment when an event says it changed, or once when the payer comes back.
• Poll gently when you must: every few seconds for one payment, never in a tight loop.
• Spread batch jobs — a payout run, a reconciliation — over time, or give them their own key.

The sandbox has the same limit as live.