> Toden documentation. For the full index fetch /llms.txt. Every page is available as Markdown by appending .md to its URL. Identity verification uses /api/kyc, Risk Intelligence uses /api/v1; they are separate contracts with different error shapes. Never invent an endpoint, field or enum value: read the API reference page for the operation first.

# Rate limits

> Request limits and how to handle 429 responses.

The API is rate limited to protect platform stability. When you exceed the limit you receive `429 Too Many Requests`:

```json
{ "error": "Too many requests, please try again later." }
```

## The limit

| Scope      | Limit        | Window     |
| ---------- | ------------ | ---------- |
| Per client | 100 requests | 15 minutes |

Responses include standard [`RateLimit`](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/) headers (draft-7), so you can read your remaining quota and reset time programmatically rather than guessing:

```
RateLimit-Limit: 100
RateLimit-Remaining: 84
RateLimit-Reset: 540
```

## Handling 429

* **Back off and retry.** Wait until the window resets (use the `RateLimit-Reset` seconds value), then retry.
* **Use exponential backoff with jitter** if you don't read the headers.
* **Reuse the same `requestId`** when retrying a verification so the retry is idempotent and never double-charges.
* **Batch and pace** bulk work instead of bursting.

> **Note**
>
> Limits may differ between sandbox and production and can be adjusted for your account. Contact Toden if your production volume needs a higher ceiling.