Guide

Rate limits

Limits keep one integration from crowding out another. They are generous for the sync patterns the API is designed for.

The limits

• 600 requests per minute per API key, counted in a fixed one-minute window. Each key in a workspace has its own budget.
• Requests without a well-formed key share a per-IP budget instead, and all traffic from one IP address sits under a coarser ceiling of 1,200 requests per minute, so a runaway client cannot dodge the limit by inventing keys.

Over the limit

Requests beyond the budget are rejected with 429 and a Retry-After header giving the seconds until the window resets. Wait at least that long before retrying.

HTTP/1.1 429 Too Many Requests
Retry-After: 23
Content-Type: application/json

{
  "code": "TOO_MANY_REQUESTS",
  "status": 429,
  "message": "Rate limit exceeded. Retry in 23s."
}

Staying under

• Use the largest limit (100) when walking pages.
• Sync with updatedAfter rather than re-reading whole date ranges — see incremental sync.
• Cache reference data (companies, accounts, categories) for minutes, not seconds; it rarely changes.
• Give each integration its own key so a runaway job cannot starve the others — and so revoking it is surgical.

If a legitimate workload needs more, contact support@paygoro.com with the key name and the pattern; limits can be raised per key.