Rate limits
The per-key and per-address request ceilings on the Gigadrive Network API, the response when you cross one, and how to back off.
The API counts requests in fixed 60 second windows. Authenticated automation is governed by a per-key budget; the per-address ceilings exist to bound traffic that never reaches a valid credential.
| Counted against | Requests per 60 seconds | Applies to |
|---|---|---|
| The API key id | 3,000 | Any request authenticated with a token issued to that key |
| Your address, with no bearer header | 600 | Any path reached without Authorization, which in practice means /oauth2/token, /.well-known/* and /docs |
| Your address, with a bearer header | 6,000 | Any path reached with one, whether the token verifies or not |
Your address, on /s3 and /files | 24,000 | The S3-compatible API and resumable uploads, which are bucketed by path before the header is looked at |
For a normal caller the key budget of 50 requests per second is the one that binds. The address ceilings bite only when one address drives many keys, or hammers tokens that do not verify. Alternating between sending and omitting the header gains nothing: both share a single counter per address and differ only in the cap applied to it.
The key budget is counted per credential, not per address, so workers sharing one outbound address each get their own 3,000. They still share the 6,000 address ceiling above them, which is why that number sits so far above the per-key one.
The 429 response
{
"error": "rate_limit_exceeded",
"message": "Too many requests. Retry after 60 seconds."
}The response carries Retry-After: 60. That is a full window rather than a precise reset time: the counter answers whether you are over budget, not when it will next roll. No headers report your remaining budget, so track your own request rate if you need to stay under the ceiling deliberately.
Backing off
Wait for Retry-After, then add jitter so a fleet does not resynchronise on the same second. Three habits keep most callers well clear of the ceiling:
Cache the access token. It is valid for 300 seconds, and /oauth2/token is charged against the smaller anonymous budget because the request carries no bearer header. Minting one token per API call doubles your request count and puts the extra half in the tighter bucket. The SDK caches and refreshes for you.
Ask for bigger pages. Where an endpoint paginates, limit goes up to 100, and up to 1,000 for storage objects and request logs. One page of 100 costs exactly what one page of 10 costs.
Stream instead of polling. Deployment logs and the application activity feed are both available over Server-Sent Events, which spends one request for the life of the connection rather than one per poll.
A 429 that is not the throttle
Some endpoints answer 429 for reasons the throttle knows nothing about, and those responses carry no Retry-After. Waiting will not clear them.
| Where | Cause | Body |
|---|---|---|
POST /applications, POST /deployments | A plan quota is used up | <Quota> quota reached (used/limit). Contact support to request a limit increase. |
| AI Gateway inference endpoints | The upstream model provider throttled the request | The OpenAI-compatible error object |
| The log stream endpoints | Too many streams already open for the resource | { "error": "too_many_concurrent_streams", "message": "..." } |
A quota 429 needs a bigger allowance rather than a slower client. See Quotas for what each plan includes and how to raise it.