Skip to main content
Infisical Cloud enforces per-minute rate limits on API requests. A global cap of 600 requests per minute per client IP applies to every endpoint (the status endpoint is exempt). On top of that, category-specific limits are tracked separately per client IP address.

​
Categories

Each API request is counted against one of the following categories:
  • Read: read operations
  • Write: create, update, and delete operations
  • Secret: secret management operations (for example, reading or creating a secret)
  • Identity creation: creating a new machine identity in an organization
  • Project creation: creating a new project in an organization

​
Limits on Infisical Cloud

A global cap of 600 requests per minute per client IP applies to every endpoint (except the status endpoint). On top of that, category-specific limits are tracked separately per client IP address. The per-category limits by plan on Infisical Cloud are:
  • Read: 200 per minute
  • Write: 90 per minute
  • Secret: 120 per minute
  • Identity creation: 30 per minute
  • Project creation: 30 per minute
Enterprise plans on Infisical Cloud can get higher custom rate limits. Contact [email protected] for details.

​
Limits on self-hosted instances

If you self-host Infisical, no rate limits are enforced on the API by default. If you need throttling on your API surface, you’ll need to configure an external rate limiter.

​
Exceeding rate limits (429 response)

A request that exceeds the applicable limit returns HTTP 429 with the standard error response:
The message field includes the number of seconds remaining in the current rate limit window. Wait at least that long before resending the request.