Rate limits
How many requests you can make, and what happens when you make too many.
Swop limits how fast any one caller can make requests, so a bug in one integration can't slow down everyone else.
The limits today
- Per key: requests that carry an
Authorizationheader are counted per key, over a rolling 5-minute window, up to 1,200 requests (an average of 4 per second). - Per IP address: every IP address also has a higher ceiling of 6,000 requests per 5 minutes, which catches floods of fake keys.
These are app-wide limits. There's no separate per-key limit or daily cap on checkouts yet.
When you hit a limit
You get a 429 with a JSON body:
{
"success": false,
"message": "Too many requests. Please try again later.",
"retryAfter": 300
}Wait retryAfter seconds, then try again. Back off further if it happens again.
Tips
- Don't poll. Use webhooks to hear about payments instead of checking every few seconds.
- Cache what doesn't change often, like your product list.
- Don't retry a checkout blindly. Creating a checkout has no idempotency key yet, so retrying a
POST /checkout-intentsafter a timeout can create a second checkout. Check your recent checkouts first.