Rate Limits

Limits protect the shared upstreams and your balance. They are enforced per key, per IP and per account.

Requests
RPM

Rolling one-minute window per key

Requests
RPD

Rolling 24-hour window per key

Each key starts on the account's default limits and can be given its own RPM/RPD budget from the dashboard. When a limit is hit the gateway answers 429 with a Retry-After header — honour it rather than hammering the endpoint.

Other ceilings you may hit

  • IP lockout. Repeated authentication failures from one address trigger a temporary block (429 ip_locked).
  • Spend cap. A key or account limit returns 429 spend_cap_exceeded even when credits remain.
  • Token quota. A per-key token budget returns 429 token_quota_exceeded.
  • Credit balance. An empty balance returns 402 insufficient_credits before the provider is contacted.
  • Public catalogue. GET /v1/catalog is rate limited per IP since it needs no key.

ExosAI

ExosAI — OpenAI-compatible AI API