SkyState

Rate Limiting ​

SkyState has two request controls:

  • Monthly API-request metering on authenticated state route groups. API-key and end-user requests are metered; developer bearer requests are exempt.
  • Standard HTTP rate limiting on API route groups to protect service availability.

Project, account, and billing management endpoints stay available when the monthly API-request quota is over limit. Monthly limits vary by subscription tier.

TierMonthly requests
free25,000
hobby250,000
pro2,000,000

A 10% grace zone applies above each limit - requests continue to be served until usage reaches 110% of the limit, at which point requests are blocked until the monthly counter resets.

Monthly counters reset on the first of each UTC calendar month.

Retry-After ​

Three responses carry a Retry-After header telling clients when to retry:

  • A request blocked by the monthly quota returns 402 with Retry-After set to the seconds until the monthly counter resets, plus a resetAt ISO timestamp in the response body.
  • Standard rate limiting is always on, in every environment, and allows 120 requests per credential (API key or bearer token) in a fixed one-minute window; a rejected request returns 429 with Retry-After: 60. Unauthenticated (credential-less) requests are not rate limited.
  • A request the API cannot serve because it could not reach its database returns 503 with Retry-After: 5. This is a temporary service fault rather than a request control - no limit was exceeded, and the request can be retried unchanged. See Errors.

Retry-After is in the CORS exposed-header set on both API policies, so browser clients can read it cross-origin on all three responses. The SkyState SDK honors it on 429 responses only: on 402 quota responses it paces retries on its own quota schedule, and on 503 responses it retries on its own capped backoff for 5xx failures.

Caching ​

The anonymous public-state endpoint used by SDK and browser clients sets Cache-Control headers. Production public-state responses are cached for 15 minutes; development and staging responses use a 10-second cache window.

Anonymous public-state reads are not counted by the monthly API-request meter. Authenticated public-state and user-state requests can be metered depending on the auth scheme.

For more detail on how metering works, see Billing - Metering.