Rate Limits
Each client is limited by default to at most 50 requests per minute
(60-second sliding window), counted independently along two dimensions; exceeding either one is rejected:
- IP bucket — the client IP (behind Cloudflare, take
CF-Connecting-IP; otherwise the socket address / XFF) - Request-fingerprint bucket — a hash of IP + User-Agent + Accept-Language + Accept + Sec-CH-UA; changing UA or headers cannot bypass the IP limit
On limit, the API returns 429 Too Many Requests,
with a Retry-After(seconds) and a X-RateLimit-* header; normal responses also carry X-RateLimit-Limit / Remaining / Reset,— use these for client-side backoff.
429 响应示例
HTTP/1.1 429 Too Many Requests
Retry-After: 37
X-RateLimit-Limit: 50
X-RateLimit-Remaining: 0
{
"ok": false,
"error": "rate limit exceeded: max 50 requests / 60s (per IP and request fingerprint), retry later"
}