Skip to main content
Rate limits protect service capacity. Identification volume is a billing allowance; Risk Score describes the check. Handle their outcomes separately.

​
The limits at a glance

The current implementation defaults are below. Deployment configuration can override gateway limits; contact Support for a capacity requirement.

​
Per-IP rate limit and the 10-minute ban

The REST budget counts HTTP requests, not completed identifications. A check can make several requests for its challenge, snapshot and follow-up network checks. Avoid repeated force-check calls and account for shared egress IPs such as corporate networks. Let the snippet connect directly from the browser.

​
Guard against the “999” ban marker

A stored result can carry the special value 999 for Banned IP. It is outside the 0–100 scoring scale. Receiving 429 does not imply that a History row or webhook will also be created.
This example validates a score locally. The Node.js SDK provides riskBand(score), which returns rate_limited for the special 999 value. Keep the protected action unverified or route it for review when evidence is unavailable. Do not group missing or all-zero device identifiers as one device.

​
Per-domain ingest (soft 429)

A domain’s visitor requests share its plan rate. A short burst can produce 429 without an IP ban. A domain freeze also returns 429; it is separate from manually pausing a domain and clears after the quiet interval. Rejected checks do not consume identification volume.

​
Concurrency cap (503)

A busy gateway can return 503. This status can also reflect an unavailable dependency or admission capacity, so do not assume it always means exactly 512 connections. Use bounded retries with backoff in server clients; preserve a pending or unavailable state for the protected action.

​
Included volume is separate (402)

HTTP 402 means the account’s available identification volume is exhausted. It does not mean requests are arriving too quickly. Billing explains allowance resets and plan changes. History and profile reads do not consume this allowance.

​
How to stay within the limits

Use regular checks for ongoing signed-in activity and force checks for specific actions. Read existing results through webhooks or bounded History retrieval. Honor server retry guidance and back off on 429/503; avoid concurrent polling loops. A History lookup for each ingest request leaves little headroom at the highest default ingest rate, so account for retries and other readers. See Errors, Optimize usage and Identification flow.