Payments API

Rate limits

Limits are per merchant (once authenticated) using the bearer token’s merchant, and per IP for POST /v1/oauth/token. OAuth also applies a per client_id bucket so distributed guessing against one integration cannot bypass the IP cap.

• Writes (collections, checkout sessions, payouts, mandates, mandate debits, mandate cancel, subscription enrollment): per-minute and per-hour caps.
• Reads: per-minute cap (status/verify/list endpoints).
• Metadata (/v1/metadata/*): separate, higher per-minute cap.
• Verifications: per-minute and per-hour caps.

Tune via MOJOPAY_THROTTLE_* environment variables. Behind a reverse proxy, set TRUSTED_PROXIES (e.g. * or your load balancer CIDRs) so client IP and limits are correct.

Response headers may include X-RateLimit-* and Retry-After. JSON may include retry_after (seconds) when available:

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Retry after a short delay.",
    "request_id": "REQ_9A1B2C3D4E5F",
    "retry_after": 42
  }
}