Rate limits & quotas
Limits are applied per IP (anonymous traffic) or per token (MCP). Exceeding one returns HTTP 429.
Limits
| Scope | Limit | Applies to | On exceed |
|---|---|---|---|
| Demo (per IP) | 30/min & 200/hr | All /api requests from anonymous or Free users (except /api/mcp/*). | 429 {demo_restricted: true} |
| Shared API (per IP) | 100/min | Endpoints tagged "Rate: 100/min" (chain, IV, flow, event, risk, 0DTE…) — one shared bucket. | 429 |
| MCP token (per token) | 60/min & 1,000/hr | /api/mcp/data/* | 429 {error: 'MCP rate limit exceeded'} + Retry-After |
| Monthly budget (per user) | 10,000 requests/month | All /api/mcp/data/* calls by your tokens combined; resets at month start. | 429 {budget_exceeded: true} |
| Auth failures (per IP) | 20 / 15 min | Failed authentications on /api/mcp/data/* — never hit by a valid token. | 429 |
- Logged-in subscribers are not subject to the demo limits; only the shared and per-endpoint limits apply.
- Upstream data quota is finite, so heavy polling may be served from cache rather than refreshed.
Quota headers
Every /api/mcp/data/* response tells you where you stand —
pace your client from these instead of discovering limits by hitting them.
Your current-month usage and a per-endpoint breakdown are also on
Account → API Access.
| Header | Meaning |
|---|---|
X-RateLimit-Limit-Minute / X-RateLimit-Remaining-Minute | Per-minute allowance and what's left of it. |
X-RateLimit-Limit-Hour / X-RateLimit-Remaining-Hour | Per-hour allowance and what's left of it. |
X-Monthly-Budget-Remaining | Requests left in your monthly budget. |
Retry-After | On 429s: seconds to wait before retrying. |