API rate limit headers and a fix for unexplained 429s

Fix

Week of September 23, 2026

Two changes for anyone syncing with the Stoked API.

Unexplained 429s fixed — a site-wide throttle meant for browser traffic was catching API requests ahead of the API’s own limit, and answering with a plain-text 429 that had no Retry-After header. API paths are now exempt from it. Every 429 you receive from the API carries Retry-After and a JSON:API error body — the per-key limit’s Retry-After is the true time left in the current window, not a fixed upper bound.
Rate limit headers — every response authenticated with an API key now includes X-RateLimit-Limit and X-RateLimit-Remaining, so a client can pace itself instead of finding the limit by tripping it. That includes a 403 from a missing permission; only a 401 (key not recognized) can’t carry them.

Related: API rate limits