Rate limits

Rate limits keep one runaway client from slowing Postforge down for everyone. Each caller has its own quota, so one integration hitting its limit never affects another.

A caller is an API key, a person signed in to the dashboard, or the Shopify app's store. Limits never count by IP address. Operations anyone may call without signing in aren't counted.

HeadersCopy Anchor Link

Every counted answer names its quotas in RateLimit-Policy (draft-ietf-httpapi-ratelimit-headers-11):

RateLimit-Policy: "standard";q=600;w=60

An expensive operation lists both: "standard";q=600;w=60, "expensive";q=60;w=60.

When you hit a limitCopy Anchor Link

You get 429 with a rate-limited problem:

HTTP/1.1 429 Too Many Requests
Content-Type: application/problem+json
Retry-After: 60
RateLimit: "standard";r=0;t=60

{"type":"https://postforge.dev/developers/problems/rate-limited","title":"Too many requests","status":429,"code":"standard_rate_limit","detail":"Too many requests: wait 60 seconds before trying again."}

async function withRetry(request: () => Promise<Response>): Promise<Response> {
  for (;;) {
    const response = await request()
    if (response.status !== 429) return response
    const seconds = Number(response.headers.get('Retry-After') ?? 60)
    // Wait as long as asked, plus up to 5 seconds of jitter.
    await new Promise((resolve) => setTimeout(resolve, (seconds + Math.random() * 5) * 1000))
  }
}

Wait at least Retry-After seconds, add a little random jitter so many clients don't come back at the same moment, and spread bulk work out instead of sending it in bursts. Limits are counted per Cloudflare location and are approximate: treat them as a ceiling, not a budget to use up.