Skip to content
  • There are no suggestions because the search field is empty.

Understanding Rate Limits

ZITADEL Cloud’s rate limiting is IP-based. Note that we also use a DDoS protection service, so repeatedly sending the same request from different IPs may still result in being blocked.

Examples:

50 requests per second over a minute

This means you can make up to 50 requests each second on average during any 60-second window. It doesn’t mean you can burst 3000 requests in one second and stay idle for the rest of the minute.

Here's how it generally works for these types of "rolling window" rate limits:

  • It's a moving average: The system continuously calculates your average request rate over the past 60 seconds.

  • Sustained rate is key: If you consistently send more than 50 requests in a given second, even if you slow down later, your 60-second average will exceed the limit, and you'll likely hit a 429 (Too Many Requests) error.

  • Bursts are usually tolerated to a degree: You might be able to briefly exceed 50 requests in one specific second if your overall rate over the minute remains at or below 50 requests per second. However, consistent bursts will quickly lead to hitting the limit.

Therefore, you are only allowed to do 50 requests every second (on average, over a minute), not 3000 requests in one second.

One Minute Banning for 50 requests per second over 3 minutes

This rule defines a stricter, long-term rate limit that can trigger a temporary ban.

  • Sustained high volume:
    If your average rate over any 3-minute window exceeds 50 requests per second, your IP may be temporarily banned.
  • Immediate bans:
    Sending bursts far above this limit — for example, 9000 requests in 10 seconds (≈900 requests/sec) — will likely trigger an instant one-minute ban (or longer, depending on internal thresholds).

In summary:

  • 50 req/sec over 1 minute: A short-term limit to handle brief spikes. Exceeding it typically returns HTTP 429 (Too Many Requests).

  • 50 req/sec over 3 minutes: A sustained-rate limit for abusive patterns. Exceeding it can cause a temporary ban.

To avoid being banned, implement exponential backoff when handling 429 responses — wait progressively longer before retrying.

Reference: