Rate limits

Limits are per key, so two partners never share a bucket. Defaults (yours may differ: see settings.rate_limits in GET /v1/me):

Bucket	Limit	Burst
per key, every route	600 / min	100
per key × location, reads	300 / min	60
per key × location, POST /orders	60 / min	20
per key × location, other writes	120 / min	30
GET /menu per key × location	60 / min (a 304 costs ½)	20
per key, POST /oauth/token	10 / min	5
failed authentications per IP	20 / 10 min, then blocked 10 min	—

Every answer carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset for the tightest bucket the call used. A 429 rate_limited carries Retry-After (seconds): wait that long, then retry with the same Idempotency-Key. The SDK does it for you. Follow webhooks rather than polling.