Rate limits

Each API key has a requests-per-minute limit (default 600), set when the key is created and editable in Core > Projects and keys (/app/core/projects). Provider capacity also applies.

When the key's limit is reached the API returns:

HTTP/1.1 429 Too Many Requests

{"error": {"message": "Rate limit of 600 requests a minute reached for this key.", "type": "rate_limited", "code": "ORYX_4292"}}

• The response carries Retry-After (seconds until the window frees up). The SDKs wait for it automatically (up to maxRetries / max_retries, default 2).
• This error comes before the request is processed, so it has no request_id.
• Hitting a limit is recorded as a security event so you can spot leaked or runaway keys.

Provider rate limits are handled by ORYVOX: a throttled provider is retried and the request falls back to another provider or model. Only when every route is throttled do you get 429 rate_limited with code ORYX_4291 (and a request_id).

Tips

• Use separate keys per service so one noisy service cannot starve another.
• Spread batch work over time and use oryvox-fast or metadata.priority: "batch" where quality allows.
• Cache hits count towards the request limit but cost nothing.