Skip to main content
Limits are applied per API key: Every response carries standard rate-limit headers:

​
Handling 429

When a limit is exceeded the API returns 429 with:
Back off and retry after RateLimit-Reset seconds. For batch workloads (e.g. issuing points for many orders), spread requests out rather than bursting — 60 writes/minute is one per second sustained.
Issuing points for many customers at once? The dashboard’s Bulk Points CSV upload handles up to 1,000 rows in one operation without consuming API rate limit.

​
Idempotent retries

Write endpoints accept an optional Idempotency-Key header. If a request times out or errors mid-flight, retry with the same key — within 24 hours you’ll get the original response back (marked with Idempotency-Replayed: true) instead of a duplicate operation.
Use a key that identifies the operation (e.g. your order ID), not a random value per attempt.