> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits and handling 429 responses

> The request budget for an API key, a signed-in person and a widget visitor, how each is counted, and how your client should read Retry-After after a 429.

Requests are limited per minute to keep the service responsive for everyone.

## Budgets

| Caller                                                          | Budget                      |
| --------------------------------------------------------------- | --------------------------- |
| An authenticated caller: each API key, or each signed-in person | 120 requests per 60 seconds |
| Unauthenticated traffic, counted per network address            | 20 requests per 60 seconds  |
| Each widget embed                                               | 20 requests per 60 seconds  |

Every endpoint is rate limited except `GET /health`.

## How requests are counted

Each request is checked twice: once by network address **before** authentication, and once by verified identity **after** it. So every request, even an authenticated one, also counts against the 20-per-minute budget of the address it came from.

<Warning>
  If many users or services reach MITHUNAI from one address, such as an office network or a single
  egress gateway, that shared address budget is what they hit first. Spread traffic across
  addresses, or talk to your MITHUNAI contact about your expected volume.
</Warning>

Other things to know:

* **Each API key has its own budget**, so one busy integration cannot exhaust another's.
* **The widget has its own budget**, separate from API traffic.
* **MCP requests** count against the API key's budget and also against a separate MCP budget of the same size.
* **A streaming answer costs one request.** Its events are not counted individually.
* **Every request costs the same**, whether it lists assistants or generates an answer.

## Handling 429

A rate-limited request returns:

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
HTTP/1.1 429 Too Many Requests
Retry-After: 37
Content-Type: application/json

{"code": "rate_limit_exceeded", "message": "Too many requests. Please retry later."}
```

* Wait the number of seconds in `Retry-After`, then retry.
* `Retry-After` is omitted when no wait is known. Fall back to exponential backoff with jitter.
* Never retry in a tight loop; that consumes the budget you need to recover.

```python theme={"theme":{"light":"github-light","dark":"github-dark"}}
import random
import time
import requests


def request_with_backoff(method: str, url: str, **kwargs) -> requests.Response:
    for attempt in range(6):
        response = requests.request(method, url, timeout=120, **kwargs)
        if response.status_code != 429:
            return response
        retry_after = response.headers.get("Retry-After")
        delay = int(retry_after) if retry_after else min(60, 2**attempt) + random.random()
        time.sleep(delay)
    return response
```

## Quotas

Rate limits bound requests per minute. Longer-term usage quotas and spend caps are planned. See [Product status](/resources/product-status).