Search docs…⌘K
Dashboard →
Reference
Rate limits
Understand how Relay protects your APIs and its own management endpoints.

Management API Limits

To ensure stability, the Relay Management API enforces the following rate limits across all workspaces based on IP address and authentication token:

  • Authentication endpoints: 20 requests per 15 minutes.
  • Standard endpoints (e.g. creating/listing APIs): 100 requests per 1 minute.
  • Sensitive endpoints (e.g. revoking API keys): 10 requests per 1 minute.

Gateway Limits

For your actual API targets, rate limiting is opt-in. When you create an API via the Create API Route, you can specify rate_limit_enabled: true, along with a rate_limit_max and rate_limit_window. These limits are evaluated per unique API Key making requests through the gateway.

Handling Rate Limits

When a rate limit is exceeded, Relay returns an HTTP 429 Too Many Requests response. The response includes standard rate limit headers to help you gracefully back off:

X-RateLimit-Limit

The maximum number of requests allowed in the current window.

X-RateLimit-Remaining

The number of requests remaining in the current window.

X-RateLimit-Reset

The Unix timestamp when the current window expires and limits are reset.