# Rate limits and quotas

A bucket per product per account, refilled by the minute, and a monthly quota. Both are on every answer.

## The bucket

Each keyed product allows an account a number of requests a minute with a burst it may spend at once; the plan sets the numbers, and `GET /v1/account` shows yours. Every keyed answer carries `RateLimit-Limit` (the requests a minute), `RateLimit-Remaining` (what the burst holds right now) and `RateLimit-Reset` (seconds until the burst is full). An empty bucket answers 429 `rate_limited` with `Retry-After`.

HTTP:

```http
ratelimit-limit: 60
ratelimit-remaining: 118
ratelimit-reset: 2
```

## The quota

A product may also carry a monthly quota, counted on the UTC calendar month. A spent quota answers 429 `quota_exceeded` with `resetsAt`, the first instant of next month, and a refused request is never counted. The free plan's numbers are on each product's page; the studio's own games run on a plan with no quota and ten times the burst, on the same code path.

429 Too Many Requests:

```json
{ "error": "the monthly quota is used up", "code": "quota_exceeded", "requestId": "req_01J9X...", "docUrl": "https://api.dietbloxycola.com/docs/errors#quota_exceeded", "resetsAt": "2026-10-01T00:00:00.000Z", "limit": 100000 }
```

## The keyless tier

The keyless endpoints have no per-caller limit; the CDN carries the load and each has a cache window. Nothing there sends the `RateLimit-*` headers.