# Rate limits

> How many requests you can send, and what the headers tell you.

Each credential has its own quota: **120 requests per minute** for a personal key, and 120 per minute per member
for an OAuth app. Every answer says where you stand, in the IETF format:

```http
RateLimit-Policy: "api-v1";q=120;w=60
RateLimit: "api-v1";r=118;t=42
```

`q` is the quota, `w` the window in seconds, `r` what is left, and `t` the seconds until the window resets.

When the quota is used up, the API answers `429` with [`RATE_LIMITED`](/developers/errors/rate-limited) and a
`Retry-After` header in seconds. Wait that long, then retry.

## Spend less

- **Revalidate.** Send the `ETag` you got as `If-None-Match`. A `304 Not Modified` has an empty body: nothing to
  download or parse again. It counts like any request.
- **Page wide.** Ask for `limit=200` when you walk a whole list.
- **Do not poll in a tight loop.** A feed of changes, designed for keeping a copy in step, arrives in a later
  release.