# Rate limits

> X-RateLimit headers on every response, 429 with Retry-After when you go over.

Source: https://docs.tryyoursize.com/guides/rate-limits/

Every API response carries:

| Header | |
|---|---|
| `X-RateLimit-Limit` | Requests allowed in the current window. |
| `X-RateLimit-Remaining` | Requests left in the window. |
| `X-RateLimit-Reset` | When the window resets. |

Over the limit, the API answers `429` with code [`rate_limited`](https://docs.tryyoursize.com/api/errors.md#rate_limited) and a `Retry-After` header (seconds). Wait at least that long, then retry with backoff. With an `Idempotency-Key`, a retried `POST` is safe.

Today limits apply **per client IP address**. Limits **per key and per plan** are coming; the headers stay the same, so code that reads them keeps working.

## Good practice

- Read `X-RateLimit-Remaining` and slow down before you reach zero, for example during a full catalog sync.
- Spread bulk work over time, use `limit=100` on lists, and send up to 25 products per [`POST /v1/recommendations`](https://docs.tryyoursize.com/guides/server-side-recommendations.md).
- Never retry in a tight loop.