+++
title = "API Error 429: Too Many Requests"
weight = 103
updated = 2026-10-07
aliases = ["/docs/api-error-429-too-many-requests.html", "/docs/bonsai-api/errors/429-too-many-requests/", "/docs/api/errors/429-too-many-requests/"]

[extra]
nav_title = "API Error 429: Too Many Requests"
weight = 20
+++

{{ legacy_api_notice() }}

An HTTP 429: Too Many Requests error occurs when an API token is used to make too many requests to the API in a given period. Bonsai limits the number of API calls that can be made by any given token in order to maintain a high level of service and prevent DoS scenarios.

The API documentation introduction [describes which limits apply](@/docs/api/legacy/overview/index.md#api-access-limitations): 60 requests per minute for each token, of which at most 5 can create clusters. An IP address that fails authentication many times in a short period can also get a 429, with the message `Too many failed authentication attempts. Try again later.`, for every request from that address until the period ends.

We are rolling these limits out gradually, so a request over a limit may still be served for now. Write your clients so they handle a 429 whenever it comes.

## Example

A call to the API that results in an HTTP 429: Too Many Requests error looks like this:

```
HTTP/1.1 429 Too Many Requests
Retry-After: 60
```

```json
{
  "errors": [
    "Rate limit exceeded. Try again later."
  ],
  "status": 429
}
```

## Troubleshooting

When the API returns an HTTP 429: Too Many Requests error, it includes a `Retry-After` header with the number of seconds to wait before your next request. Wait at least that long before retrying, rather than retrying right away, ideally with some backoff. That way an HTTP 429 does not cause things to fail, but rather informs the necessary sleep duration in order to proceed.

The next step is to look at how often you are polling the API. If you're checking the API while waiting for a cluster to provision or update, then every 3-5 seconds should be adequate.

If you have an adequate amount of sleep time in between API calls, then the next thing to check would be whether you have multiple jobs checking the API using the same token. If you're using some kind of CI system to spin up and tear down clusters during testing and continuous integration, and they all share the same token, then they're likely interfering with each other. Limits are counted per token, so giving each job its own token keeps them from using up each other's requests.

If all else fails, you can always [contact support](mailto:support@bonsai.io) and we will be glad to assist.