Rate limiting

​

Default limit

{ "error": "Rate limit exceeded" }

​

Which endpoints enforce it

​

Best practices

1. Cache access decisions. Entitlement results are stable within a billing period. Common patterns:
   • React SDK hooks already cache for 30 seconds (useCompanyEntitlements).
   • For server checks, cache checkEntitlement/checkFlag results for 30–60 seconds when acceptable.
2. Batch reads. Use GET /api/v1/entitlements (all features in one call) instead of many /check calls.
3. Retry with backoff. On 429, wait and retry. Exponential backoff with a small jitter avoids synchronized retry storms.

async function checkWithRetry(client, key, companyId) {
  for (let attempt = 0; attempt < 5; attempt++) {
    try {
      return await client.checkEntitlement(key, { id: companyId });
    } catch (error) {
      if (error.statusCode !== 429) throw error;
      const backoff = 100 * Math.pow(2, attempt) + Math.random() * 50;
      await new Promise((resolve) => setTimeout(resolve, backoff));
    }
  }
}

4. Use embed tokens for customer-scoped reads. Browser reads (hooks, ArcenEmbed) authenticate with the customer’s access token, not your API key, so they do not consume your server key’s quota.

​

Related

• Authentication — key types and the endpoint auth matrix
• Errors — the 429 error response and handling patterns