# Rate limits

Two limiters run on Partner API routes: 60 requests per minute per IP before auth finishes, then 120 per minute per API key.

| Limiter | Window | Key |
| --- | --- | --- |
| partner-api-ip | 60 / minute | Client IP |
| partner-api | 120 / minute | Authenticated key id |

**429**

```
HTTP/1.1 429 Too Many Requests
Retry-After: 30
```

Back off using Retry-After. Burst traffic from a webhook worker plus a CRM sync on the same key shares the 120/min budget. Prefer webhooks over polling.