Rate limit

Every machine has its own bucket — a looping app never slows down the farm's real users.

Caller	Limit	Counted per
App token (OAuth)	600 / minute	`app × farm`
API key nfk_	600 / minute	`key`
`POST /api/v1/iam/oauth/token`	10 / minute	IP

Header

Header	Meaning
`X-RateLimit-Limit`	Calls allowed per minute (600).
`X-RateLimit-Remaining`	Calls left in the bucket.
`X-RateLimit-Reset`	Seconds until the bucket is full again.
`Retry-After`	Only on 429: wait that many seconds, then retry.

429

HTTP/1.1 429 Too Many Requests
Retry-After: 1
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 0

{ "title": "rate-limit-exceeded", "status": 429 }

Your app Dashboard shows this minute's usage, the 24-hour peak and 429s over 7 days. Apps with ≥ 200 calls/hour and > 50% 4xx are suspended automatically (Reactivate on the Publish page).