429 Too Many Requests

What 429 means

Rate limiting. The server may include a Retry-After header saying how long to wait, and often RateLimit-* or X-RateLimit-* headers describing the quota.

Limits are usually per API key, per IP or per user. Behind a shared NAT or a proxy that hides client IPs, one busy tenant can get everyone limited.

Common causes

• A client polling too fast or retrying in a tight loop.
• Many users behind one IP hitting a per-IP limit.
• A misconfigured proxy that does not forward X-Forwarded-For, so all traffic looks like one client.

How to fix it

• Honour Retry-After and back off exponentially with jitter.
• Cache responses and batch requests.
• Servers: trust the proxy's forwarded IP so limits apply per real client.

What it looks like

A typical response:

HTTP/1.1 429 Too Many Requests
Retry-After: 30
RateLimit-Limit: 600
RateLimit-Remaining: 0

The same event in an nginx access log (the status is the number after the request line):

203.0.113.7 - - [10/Sep/2026:10:12:01 +0000] "GET /api/search HTTP/1.1" 429 153 "-" "Mozilla/5.0"

Check it with curl

-i prints the status line and headers, and -w '%{http_code}' prints only the number, which is handy in scripts and health checks. Replace the URL with yours:

curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com/api/orders

Compare what curl sees with what the browser sees. A different status from the same URL usually means a cache, a CDN edge or a cookie is in the way.

Investigating a run of 429s? Paste the log excerpt into Log Share to get line numbers, highlighting and an expiring link for whoever is on call with you.

Related status codes

• 503Service Unavailable: The server is temporarily unable to handle the request.
• 403Forbidden: The server understood the request and refuses to authorise it.
• 408Request Timeout: The client took too long to send the request.

FAQ