Rate limits
Learn about API rate limits and how to work with them.
Overview
Pandabase limits request rates by IP address, account, and store.
Rate Limiter Types
Pandabase uses three types of rate limiters, depending on the endpoint and resource being accessed:
- Global IP-based limiter (
GlobalResource): Applies to all requests from a specific IP address - Account-based limiter (
AccountResource): Applies to requests authenticated with your API key - Store-based limiter (
StoreResource): Applies to requests specific to a storefront/shop
How It Works
Account limits are generally stricter and change more often than IP limits.
Rate limits can change. Implement retry logic and respect the rate limit headers in API responses.
Rate Limit Headers
All API responses include the following headers to help you manage your request rate:
| Header | Description |
|---|---|
X-RateLimit-Limit | The maximum number of requests permitted within the current rate limit window. |
X-RateLimit-Remaining | The number of requests remaining in the current rate limit window. |
X-RateLimit-Reset | The time at which the current rate limit window resets (UTC epoch seconds). |
X-RateLimit-Type | The type of rate limiter applied (GlobalResource, AccountResource, or StoreResource). |
Handling Rate Limits
When you exceed the rate limit, the API returns a 429 Too Many Requests response:
{
"ok": false,
"error": "Rate limit exceeded. Please retry after the reset time."
}Best Practices
- Monitor headers: Check
X-RateLimit-Remainingto track available requests - Implement exponential backoff: When you receive a
429response, wait before retrying - Respect reset times: Use
X-RateLimit-Resetto determine when to retry - Cache responses: Reduce API calls by caching data when appropriate
- Batch requests: Where possible, combine multiple operations into single requests
Example Retry Logic
async function makeRequestWithRetry(url, options, maxRetries = 3) {
for (let i = 0; i < maxRetries; i++) {
const response = await fetch(url, options);
const data = await response.json();
if (response.status === 429 && !data.ok) {
const resetTime = response.headers.get("X-RateLimit-Reset");
const waitTime = resetTime * 1000 - Date.now();
if (i < maxRetries - 1) {
await new Promise((resolve) => setTimeout(resolve, waitTime));
continue;
}
}
return { response, data };
}
}
// Usage
const { response, data } = await makeRequestWithRetry(
"https://api.pandabase.io/stores/[storeId]",
{
method: "GET",
headers: {
Authorization: "Bearer sk",
"Content-Type": "application/json",
},
},
);
if (data.ok) {
console.log("Success:", data.data);
} else {
console.error("Error:", data.error);
}Rate Limit Variations
Limits vary by endpoint and plan:
- Endpoints have different limits based on the resources they use
- Limits can change over time
- Higher-tier plans may have increased rate limits
Always rely on the headers returned in each API response to determine your current rate limit status rather than hardcoding values.