Rate Limits

Two layers: a Redis-backed baseline that backstops every mutating call, and tighter per-route budgets on anything that moves money or sends messages. Limits hold across all serverless instances.

The baseline

Every mutating request (POST/PUT/PATCH/DELETE) passes a per-IP budget of 150 requests per minute in the edge middleware. It is generous enough that no legitimate client hits it — it exists to blunt floods, not to meter usage. Signature-authenticated webhooks are exempt (providers batch deliveries from few IPs).

Per-route budgets

Handling 429

A rejected request returns 429 with a Retry-After header (seconds):

const res = await fetch("/api/transfers/gasless", { method: "POST", body });
if (res.status === 429) {
  const wait = Number(res.headers.get("retry-after") ?? "5");
  await new Promise((r) => setTimeout(r, wait * 1000));
  // retry ONCE — if it 429s again, back off exponentially
}

• Respect Retry-After exactly — retrying earlier just resets your window.
• For agents: budget your call rate below the limit rather than treating 429 as flow control.
• x402 flows should reuse the pending-settlement poll path instead of re-requesting quotes in a loop.