Rate Limiting

SkyState has two request controls:

• Monthly API-request metering on authenticated state route groups. API-key and end-user requests are metered; developer bearer requests are exempt.
• Standard HTTP rate limiting on API route groups to protect service availability.

Project, account, and billing management endpoints stay available when the monthly API-request quota is over limit. Monthly limits vary by subscription tier.

Tier	Monthly requests
free	25,000
hobby	250,000
pro	2,000,000

A 10% grace zone applies above each limit - requests continue to be served until usage reaches 110% of the limit, at which point requests are blocked until the monthly counter resets.

Monthly counters reset on the first of each UTC calendar month.

Retry-After

Both request controls tell clients when to retry:

• A request blocked by the monthly quota returns 402 with Retry-After set to the seconds until the monthly counter resets, plus a resetAt ISO timestamp in the response body.
• Standard rate limiting is always on, in every environment, and allows 120 requests per credential (API key or bearer token) in a fixed one-minute window; a rejected request returns 429 with Retry-After: 60. Unauthenticated (credential-less) requests are not rate limited.

Retry-After is in the CORS exposed-header set on both API policies, so browser clients can read it cross-origin. The SkyState SDK honors it on 429 responses; on 402 quota responses the header is readable but the SDK paces quota retries on its own schedule.

Caching

The anonymous public-state endpoint used by SDK and browser clients sets Cache-Control headers. Production public-state responses are cached for 15 minutes; development and staging responses use a 10-second cache window.

Anonymous public-state reads are not counted by the monthly API-request meter. Authenticated public-state and user-state requests can be metered depending on the auth scheme.

For more detail on how metering works, see Billing - Metering.