Each token gets 60 requests a minute, and up to 20 of those can be writes. The count resets at the top of each clock minute, and it's exact.
Every authenticated response tells you where you stand. A read reports the 60-a-minute window, and a write reports the 20-a-minute window:
RateLimit-Limit: 60
RateLimit-Remaining: 41
RateLimit-Reset: 45RateLimit-Reset is the number of seconds until the count starts over. Over the limit, you get 429 rate_limited and a Retry-After header. A call that fails still counts.
The app's own limits apply too, because the API runs the same rules. A second nudge inside the nudge window gets 409 conflict whichever way you send it.
| Active tokens per person | 20 |
| Webhooks per person | 10 |
| Bad tokens from one address | 10 a minute, then blocked for 60 seconds |
| Page size | ?limit= up to 100, default 50, and 100 on the events feed |