Skip to main content

Understand rate limits

Stay within Otter API quotas so your integration remains reliable under load.

Overview​

The Otter API enforces rate limits so capacity stays fair across partners. Limits apply in two ways: by IP address and by endpoint (per store and application).

IP address limits​

Limits depend on whether the request is authenticated:

Auth stateLimit
Authenticated20 requests per second per IP (all endpoints combined)
Unauthenticated3 requests per minute per IP

Endpoint limits​

Authenticated endpoints are rate limited individually at the store level for your application. For example, one store for one application might be allowed a fixed number of calls per minute to a given endpoint.

Exact quotas depend on the endpoint. See the per-operation Rate limit note on each page in the API reference.

When you hit a limit​

  • The API responds with HTTP 429 until usage drops below the threshold.
  • Back off and retry with jitter. Do not tight-loop on 429.
  • If you hit limits often in normal traffic, contact your TAM to review quotas or redesign chatty patterns (batching, caching, fewer polling loops).

Verify​

Intentionally exceed a low-volume path only if you have a safe test plan. Confirm you receive 429 and that your client backs off. Prefer load testing against agreed quotas with your Account Representative.

Next​