> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postsider.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PostSider API Rate Limits

> How rate limiting works on the public API: the per-organization window, headers, and what happens on 429.

The public API limits each organization to **60 requests per minute** by default. Self-hosted operators can change this with the `API_LIMIT` environment variable.

## Headers

| Header                  | Description                                     |
| ----------------------- | ----------------------------------------------- |
| `X-RateLimit-Limit`     | Maximum requests allowed in the current window. |
| `X-RateLimit-Remaining` | Requests remaining in the window.               |
| `Retry-After`           | Seconds to wait, sent only on a `429`.          |

## When you are limited

Exceeding the window returns `429` with a body such as:

```json theme={null}
{ "msg": "Too many requests", "retryAfter": 30 }
```

Wait `retryAfter` seconds before retrying. A client that keeps retrying without backing off stays limited.

## Scope

The 60-per-minute guard applies to every route that resolves an organization, which includes the `/public/v1` endpoints. Other application routes (dashboard sessions) use a separate, higher global throttler, so their limits are not the same as the public API window.

## Idempotency and retries

For `POST /public/v1/posts`, send a stable `Idempotency-Key` so a retry after a `429` or network failure does not create a duplicate post. Replaying the same key returns the original result.