Are there rate limits for the API?

[myConsciousness]

Hi,

As the title says, is there a rate limit for the APIs? Or do you plan to implement rate limit before releasing a stable version?

Thank you.

[dholms]

Yup we will be implementing rate limiting at some point soon however the main purpose will be to prevent abuse. It should remain fairly easy to build on without hitting limits. We'll have more details soon!

[myConsciousness]

Thanks, I will be waiting for news! :)

[Broken60]

Thanks, I will be waiting for news! :)

Yep sure will

[keevitaja]

current rate limit is 100 per day. this is way too low. is it due to massive new users signing up? this is what i get from reponse

    'ratelimit-limit': '100',
    'ratelimit-policy': '100;w=86400',
    'ratelimit-remaining': '0',
    'ratelimit-reset': '1732077304',

[mhdsbq]

Hi,
Any updates on the rate limits

[dholms]

yup we have a rate limit set to 3000 reqs/5 min for now

lower for some routes like createAccount & we selectively action IPs that are being clearly abusive

[thepudds]

FYI, in #1057 (comment), @dholms mentioned that it is most likely a 403 that gets returned if you exceed your rate limit.

[thepudds]

Also, FWIW, the xrpc docs suggest a 429 would be returned for rate limit exceeded:
https://atproto.com/specs/xrpc#429-rate-limit-exceeded

@dholms, I could file an issue for 403 vs. 429 if that's helpful, but I don't want to add to the noise if that's not helpful. 😅

(I'm fine as is for my own current purposes).

[Broken60]

I'm fantastic 😂

[Broken60]

Y’all really think u gonna get what ever it is y’all looking for

[Broken60]

Prolly not

[Zero3K]

Please read the above comments.

[Zero3K]

A guy is complaining about the rate limit. You can see it at https://bsky.app/profile/nonameinsect.bsky.social/post/3k37rlsw3ad24.

EDIT: Many people are complaining about it. Just search for rate limit.

[devinivy]

There was a period of about eight minutes today where users of the app experienced this when viewing their timeline. It was an unintended consequence of a mitigation to a distributed attack that we were experiencing, and was quickly reversed. In short, the rate limits are not intended for humans and there aren't cases during normal operations where the app should rate limit you. The limits are intended to prevent abuse vectors 👍

[Zero3K]

Is there any way to prevent that from ever happening again?

[MedeHurGang]

yup we have a rate limit set to 3000 reqs/5 min for now

lower for some routes like createAccount & we selectively action IPs that are being clearly abusive

Are those 10 reqs/sec per IP or per User. For example if i host 2 bots and im beeing logged in to app and my 3 roommates via webbrowser behind our DSL IP. Will all this requests count or is there a seperate rate limit for every account used?

[dholms]

the rate limits vary per endpoint - some are limited by IP and some are limited by user id (DID)

both are important in conjunction 👍

[dan42]

So I hit the rate limit while writing and testing a very simple script. Just createSession + uploadBlob + createRecord (following instructions from https://atproto.com/blog/create-post). Edit the script, run it, rinse and repeat a few times per minute while debugging. But I'm now getting 429 errors on createSession, with these interesting headers:

"ratelimit-limit"=>["30"],
"ratelimit-remaining"=>["0"],
"ratelimit-reset"=>["1694912614"],
"ratelimit-policy"=>["30;w=300"],

So I can only do 30 API calls per 300s? And if I go over the limit I'm blocked for 24h. That's very different from the 3000 reqs/5 min mentioned above.

[MedeHurGang]

you hit the sessioncreate limit, happend to me too.

well explained here:

https://atproto.com/blog/rate-limits-pds-v3

[rmdes]

is the block really 24h?

[MedeHurGang]

depends on when you used the last of the 30 requests it starts when you use the first of the 30 requests and resets after 24 hours. so it can be way shorter than 24 hours depending on how often you called sessionCreate endpoint.

i filed an issue on this yesterday. #1616

[syui]

I received "Rate Limit Exceeded". This is the first time this has happened.
Should I use refreshSession instead of createSession?

[MedeHurGang]

have a look here for latest ratelimit changes

https://atproto.com/blog/rate-limits-pds-v3

[syui]

ok, I rewrote the code to refresh-token.

[azu]

I am running a script that retrieves my posts every 15 minutes to record my posts.
I have just started getting RateLimit errors since yesterday.

{"status":429, "error": "RateLimitExceeded", "success":false, "headers":{"access-control-allow-origin": "*", "connection": "keep-alive"," content-length": "61", "content-type": "application/json; charset=utf-8", "date": "Sat, 16 Sep 2023 22:58:38 GMT", "etag": "x", "ratelimit-limit ": "30", "ratelimit-policy": "30;w=300", "ratelimit-remaining": "0", "ratelimit-reset": "1694911502", "vary": "Accept-Encoding", "x-powered- by": "Express"}}

The script is as simple as login + getAuthorFeed. Is there a way around this Rate Limit error?

• Source: https://github.com/azu/bluenotiondb/blob/d9e9243a95a44404fe2ced64a3caa19d981637f1/src/services/bluesky.ts#L84-L106

[MedeHurGang]

i guess there is an error in implementation of the createSession ratelimit. the blog post descriped 30/5min also the header does.
"ratelimit-policy": "30;w=300"
but actually the server seems to be configured 30/day which should be 300/day and 30/5min.
i've opened an issue on this (#1616) yesterday, but got no response yet.

[dan42]

Rate limiting is still broken. Tested posting 2 in a row, with uploadBlob for an external embed

{"server.refreshSession"=>{"ratelimit-limit"=>["3000"], "ratelimit-remaining"=>["2969"], "ratelimit-reset"=>["1695745115"], "ratelimit-policy"=>["3000;w=300"]}}
{"repo.uploadBlob"=>{"ratelimit-limit"=>["3000"], "ratelimit-remaining"=>["2968"], "ratelimit-reset"=>["1695745115"], "ratelimit-policy"=>["3000;w=300"]}}
{"repo.createRecord"=>{"ratelimit-limit"=>["5000"], "ratelimit-remaining"=>["4988"], "ratelimit-reset"=>["1695748555"], "ratelimit-policy"=>["5000;w=3600"]}}
----------------------------------------------------------------------------------------------------
{"server.refreshSession"=>{"ratelimit-limit"=>["3000"], "ratelimit-remaining"=>["2965"], "ratelimit-reset"=>["1695745115"], "ratelimit-policy"=>["3000;w=300"]}}
{"repo.uploadBlob"=>{"ratelimit-limit"=>["3000"], "ratelimit-remaining"=>["2964"], "ratelimit-reset"=>["1695745115"], "ratelimit-policy"=>["3000;w=300"]}}
{"repo.createRecord"=>{"ratelimit-limit"=>["5000"], "ratelimit-remaining"=>["4985"], "ratelimit-reset"=>["1695748555"], "ratelimit-policy"=>["5000;w=3600"]}}

Notice how the ratelimit-remaining is shared for server.refreshSession and repo.uploadBlob, and how it goes from 2969 to 2968 to 2965 to 2964, skipping a few along the way.

Also I'm getting timeouts really often when trying repo.uploadBlob (~50KB blobs), but I don't know if that's related to rate limits.

[kesma01]

Hi,

i just wanted to collect data from followers of a user, using bsky_cli. I am building a feed and need as much as possible scientists in a list, posting on climate change. The follower base of the user is 3.1 K, and i got the RateLimitExceeded error for the first time.
I can understand that there should be a mechanism so the servers should work without interruptions.
The option i have is either to implement something to put execution into sleep, while collecting data. Or to be unfair and "grow" couple of Bsky accounts, so i could switch in-between them, while executing calls.

Rgds,
Kesma

[bnewbold]

If you are iterating through thousands of calls, the best would be some form of backoff and retry on calls that fail with 429 (rate limit exceeded). HTTP clients and libraries are available for many programming languages that help with this kind of backoff.

and just to be clear: sounds like a cool project!

[Programmer-Lily]

im getting rate limited just testing a script that runs a search every 5 min, something is clearly wrong :(

[keevitaja]

i ran into the same issue. it looks like current rate limit is 100 request per day. i assume it includes all requests you make.

    'ratelimit-limit': '100',
    'ratelimit-policy': '100;w=86400',
    'ratelimit-remaining': '0',
    'ratelimit-reset': '1732077304',

[nukeador]

At least the createSession endpoint is also returning me 100 requests per day too, instead of the 300 listed on the documentation.

RateLimit-Policy: 100;w=86400

cc @dholms @bnewbold