---
title: "Rate limits"
url: "https://coldmeetings.com/docs/rate-limits.md"
canonical_url: "https://coldmeetings.com/docs/rate-limits"
last_updated: "2026-10-17"
type: "conceptual"
summary: "The ColdMeetings API allows each key a burst of 200 requests and refills at 20 a second. Headers, the 429 response and other limits are listed here."
related: ["https://coldmeetings.com/docs/errors.md", "https://coldmeetings.com/docs/authentication.md"]
---

# Rate limits

> **For AI agents:** the complete index of ColdMeetings pages is [llms.txt](https://coldmeetings.com/llms.txt). Every page is also served as markdown at its URL plus .md.

The ColdMeetings API allows each key a burst of 200 requests and refills at 20 a second. Headers, the 429 response and other limits are listed here.

Each API key may make 200 requests per 10 seconds. The limit is the same for every plan and every operation under `/v1`.

## How it works

- Each key has a bucket that holds up to 200 requests. A request takes one. The bucket refills continuously at 20 requests per second.
- A burst of up to 200 requests succeeds at once. After that you can sustain 20 requests per second.
- The limit is per key, not per account or per IP address.
- The public endpoints `/health`, `/plans`, `/openapi.json` and `/llms.txt` are not rate limited.
- Requests that fail authentication are not counted.
- Each API server process keeps its own buckets in memory. If more than one process serves the API, the limit applies to each process separately.

## Response headers

Every authenticated response carries these headers.

| Header | Meaning |
| --- | --- |
| `X-RateLimit-Limit` | The bucket size, 200. |
| `X-RateLimit-Remaining` | Whole requests left right now, after this one. |
| `X-RateLimit-Reset` | Unix time in seconds when the bucket is full again. |
| `Retry-After` | Only on a refused request: seconds to wait before retrying. |

## When you are limited

The API answers HTTP 429 with the `rate_limited` code and `retryable: true`. Wait for `Retry-After` seconds and retry. See [Errors](https://coldmeetings.com/docs/errors.md#rate_limited).

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key.",
    "fix": "Wait the number of seconds in the Retry-After header, then retry. Spread requests out to stay under the X-RateLimit-Limit value.",
    "docs_url": "/docs/errors#rate_limited",
    "retryable": true,
    "request_id": "req_Qx7RtVw3ZbN1pEs9fKd2Lm"
  }
}
```

```js
async function withRetry(send, attempts = 4) {
  for (let i = 0; i < attempts; i += 1) {
    const res = await send();
    if (res.status !== 429) return res;
    const wait = Number(res.headers.get('retry-after') ?? 1);
    await new Promise((resolve) => setTimeout(resolve, wait * 1000));
  }
  throw new Error('still rate limited');
}
```

## Other limits

| Limit | Value | Error when exceeded |
| --- | --- | --- |
| Request body size | 256 KiB | `payload_too_large` |
| Prospects per import request | 500 | `invalid_input` |
| Steps in a sequence | 6 | `invalid_input` |
| Variants per step | 4 | `invalid_input` |
| Days between steps | 0 to 30, and at least 1 after the first step | `invalid_input` |
| Reply body length | 20,000 characters | `invalid_input` |
| Domains, mailboxes and active campaigns | By plan, see [Credits and billing](https://coldmeetings.com/docs/credits-and-billing.md) | `plan_limit` |

## Related

- [Errors](https://coldmeetings.com/docs/errors.md)
- [Authentication](https://coldmeetings.com/docs/authentication.md)