Rate limits

Each API key gets its own token bucket. The bucket refills at the configured per-minute rate (default 60); requests over that rate get 429 Too Many Requests with a Retry-After header indicating seconds until the next token.

Error shape

HTTP 429

{
  "error": {
    "type": "rate_limit_exceeded",
    "message": "rate limit exceeded; retry in 3s"
  }
}

Tuning

The default per-minute rate is set globally via the SABLE_RATE_LIMIT_PER_MIN environment variable on the gateway.

You can also override it per key. Pass rate_limit_per_min when you mint a key (see API key controls) and that key gets its own bucket; leave it off and the key uses the global default. Handy for giving a high-throughput agent more headroom, or boxing a noisy one in.

Other limits

The per-key bucket isn't the only one. Independently of it:

• Public endpoints (models, nodes, receipt verification, auth bootstrap) are limited per client IP, default 60/min (SABLE_PUBLIC_RATE_LIMIT_PER_MIN).
• Authenticated surfaces carry a per-IP limit that runs before authentication, default 300/min (SABLE_AUTH_IP_RATE_LIMIT_PER_MIN), so failed auth attempts are rate-limited too.
• The keyless assistant has its own tighter per-IP limit, default 20/min (SABLE_ASSISTANT_RATE_LIMIT_PER_MIN).

All of them answer the same way: 429 with a Retry-After header.