Rate Limits

Global rate limit

Every API request counts against a global limit. Which budget a request uses depends on how it is authenticated:

When a limit is exceeded, the API responds with 429 Too Many Requests.

Rate limit headers

Responses from rate-limited endpoints include these headers:

Slow down when RateLimit-Remaining gets low, and after a 429, wait Retry-After seconds before retrying.

Endpoints with their own limiter, such as login or KYC, also count against the global limit. On those endpoints the headers describe the endpoint’s own limit, not the global one, so RateLimit-Limit can differ between endpoints. The NotFound limiter is the exception: its responses show the global values, and its 429 has no Retry-After.

Raised merchant limits

If Coinflow has raised your merchant limit above the 400 per-IP budget, your server-to-server calls can use it on endpoints that take a session key. Send your merchant API key in the Authorization header alongside x-coinflow-auth-session-key, and those requests count against your merchant budget instead of the per-IP budget.

Your merchant budget is shared by every request using your key, across all of your servers. The per-IP budget applies to each server separately, so if your traffic comes from several servers, check that your merchant limit covers their combined traffic before switching.

If your server-to-server traffic needs more than these limits allow, contact your Coinflow integrations representative to request a higher merchant limit.