Rate Limits
Here are some good-to-know rate limits that apply to both you and your customers:
Global rate limit
Every API request counts against a global limit. Which budget a request uses depends on how it is authenticated:
When a limit is exceeded, the API responds with 429 Too Many Requests.
Raised merchant limits
If Coinflow has raised your merchant limit above the 400 per-IP budget, your server-to-server calls can use it on endpoints that take a session key. Send your merchant API key in the Authorization header alongside x-coinflow-auth-session-key, and those requests count against your merchant budget instead of the per-IP budget.
Your merchant budget is shared by every request using your key, across all of your servers. The per-IP budget applies to each server separately, so if your traffic comes from several servers, check that your merchant limit covers their combined traffic before switching.
Only send your merchant API key from your servers. Never include it in browser or mobile app code, where anyone can extract it. Requests made from your customers’ browsers or devices should send only the session key.
If your server-to-server traffic needs more than these limits allow, contact your Coinflow integrations representative to request a higher merchant limit.