Skip to main content
Authenticated API traffic (sk_, rk_, pk_ keys) is rate-limited per key with a fixed window of 5,000 requests per 60 seconds. The ceiling is intentionally generous — it exists to stop runaway retry loops and hostile bursts, not to shape normal SDK, agent, dashboard, or docs-playground traffic.

​
What that means

​
When the limit is hit

Exceeding the per-key window returns 429:
The window is a fixed 60-second bucket that resets on its own. Back off and retry after it resets — there is no separate daily cap.

​
Anonymous request protection

Requests with no valid ArcenPay key (anonymous scraping, an unauthenticated curl, unknown-origin browsers) are covered by Arcjet shield + bot detection. This prevents anonymous abuse of the API while never touching key-verified traffic.
Shield/bot protection is only active in NODE_ENV=production with a real ARCJET_KEY. In development, Arcjet runs in dry-run mode.

​
Best practices

  1. Reuse one key per integration. The limit is per key; spreading traffic across many keys to evade it is not supported.
  2. Cache access decisions. Entitlement results are stable within a billing period:
    • React SDK hooks already cache for 30 seconds (useCompanyEntitlements).
    • For server checks, cache checkEntitlement/checkFlag results for 30–60 seconds when acceptable.
  3. Batch reads. Use GET /api/v1/entitlements (all features in one call) instead of many /check calls.
  4. Use embed tokens for customer-scoped reads. Browser reads (hooks, ArcenEmbed) authenticate with the customer’s access token for a clean, scoped session.
  • Authentication — key types and the endpoint auth matrix
  • Errors — the 429 error response and handling patterns
Last modified on October 4, 2026