## Rate limits

Every API-key endpoint allows **60 requests per minute**, counted per API key in a rolling 60-second window.

Each response carries `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset`. A rejected request also carries `Retry-After`, and the body repeats the wait as `retryAfterSeconds`.

> **The limit is counted before your key is checked**
>
> Requests are bucketed by the token in the `Authorization` header, and that happens before the key is validated. Requests made with a revoked or mistyped key still consume that token's budget, and requests with no `Authorization` header at all share a single per-IP bucket.

> **Two different limits return 429**
>
> This per-minute limit is not the only one. [FaceTime](https://api.tryprojectblue.com/#facetime-end) separately caps dialling at 40 unique destinations per calendar day and returns 429 with `error_code: FACETIME_DAILY_LIMIT_REACHED`. Branch on `error_code` rather than on the status alone: waiting `retryAfterSeconds` will never clear the daily cap.

**Response — 429**

```json
{
  "error": "Rate limit exceeded",
  "message": "Too many requests. Please wait before sending more messages.",
  "retryAfterSeconds": 60
}
```