Rate limits¶

Limits apply per client_id and per IP. The stricter of the two wins.

Defaults¶

Headers¶

Every response includes:

http X-RateLimit-Limit: 1000 X-RateLimit-Remaining: 942 X-RateLimit-Reset: 1714684800

When throttled, you get:

http HTTP/1.1 429 Too Many Requests Retry-After: 47 X-RateLimit-Reset: 1714684847

with body:

json { "error": "lxl_rate_limited", "error_description": "Hourly cap exceeded for /oidc/token" }

Raising your limits¶

Apply through the developer portal — pick the client, Settings → Rate limits → Request increase. Provide:

• Expected sustained QPS.
• Endpoint(s).
• Brief justification (use case).

We approve in business hours. Burst allowance is configurable separately.

Best practices¶

• Cache /oidc/userinfo for the duration of the access token. It rarely changes.
• Honor Retry-After. Implement exponential backoff with jitter; don't hammer.
• Use webhooks instead of polling for account state changes.
• Reuse the discovery document — it's cacheable.