Rate Limits
Public checkout endpoint
The endpoint checkout.js calls is limited per IP address.
| Endpoint | Limit |
|---|---|
POST /v1/public/checkout/button-session |
20 per minute |
This is per visitor, so real traffic never reaches it. Hitting the limit normally means something is clicking a button in a loop.
Authentication
| Endpoint | Limit |
|---|---|
POST /auth/magic-link |
5 per minute |
Authenticated API endpoints
POST /v1/payment-links has no rate limit applied today.
Do not build on that
It is a current fact, not a guarantee. Handle 429 and retry with a backoff so a limit introduced later does not take your integration down.
The monthly payment cap
Separate from rate limits, and nothing to do with request volume.
| Plan | Completed payments per calendar month |
|---|---|
| Free | 30 |
| Pro | Unlimited |
Only completed payments count. Creating a link that is never paid costs nothing against the cap.
When the cap is reached:
POST /v1/payment-linksreturns402- Both public checkout endpoints return
402 - Payments already pending can still complete
The count resets on the 1st.
Next steps
- Authentication - the full error code table
- Payment Links API - the endpoint the cap applies to