Rate Limits

Understanding API request limits and monthly transaction quotas across all plans.

Monthly Transaction Limits

Each plan includes a monthly number of payments. A payment counts once, when it completes: a checkout that is opened and abandoned costs nothing. The counter resets on the 1st of every calendar month.

Counts toward limit

Payments created with POST /transactions/create, POST /transactions/create-detailed or a payment link that reach completed

Does not count

Checkouts that expire unpaid, failed requests, test mode (sk_test_) transactions, GET calls, market data, and authentication checks

When the monthly limit is reached

There is no overage and there are no per transaction fees. Once the month's completed payments reach your plan's limit, creating a new transaction returns 429 MONTHLY_LIMIT_REACHED until the 1st of next month, or until you upgrade the plan. Checkouts that were already open when you hit the limit can still be paid. The first time an account reaches its limit, 5 more payments go through that month, free, so a growing shop is not cut off mid sale.

429, Monthly limit reached

{
  "success": false,
  "error": "MONTHLY_LIMIT_REACHED",
  "message": "Monthly transaction limit reached (300/300). Upgrade your plan to keep accepting payments this month."
}

Request Rate Limits

Separately from the monthly transaction allowance, every API key is throttled on two windows at once, per minute and per hour. Both depend on your plan.

Plan	Requests / minute	Requests / hour
Starter	30	500
Business	100	2 000
Professional	300	5 000
Enterprise	1 000	20 000

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (Unix timestamp). A throttled request returns 429 with a Retry-After header, wait that many seconds rather than retrying immediately.

Two different limits return 429, and they need different handling. RATE_LIMIT_EXCEEDED means you are sending too fast right now, back off and retry after Retry-After. MONTHLY_LIMIT_REACHED means your plan is out of transactions for the month, retrying will not help until next month; upgrade the plan to continue now.

IP-Based Throttling

Server-side secret keys (sk_live_ / sk_test_) are not subject to per-IP throttling. You can make as many API calls as your plan permits.

Best Practices

Check GET /transactions/list before creating a transaction server-side if a duplicate might already exist.

Polling payment status without webhooks? Check all open payments in one request: GET /transactions/list?ids=MTX-…,MTX-… (up to 100 ids, secret key). Poll only while a payment is open, every 30 seconds is plenty.

Cache exchange rates from GET /prices, rates refresh periodically, not on every API call.

Monitor your monthly usage in the Dashboard (you also get an email at 80% and 100%) so the limit never surprises you.