> ## Documentation Index
> Fetch the complete documentation index at: https://docs.docksys.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate Limits

> Understand Dock API quotas, retry headers, verification-session limits, and abuse-prevention rules.

Dock rate limits requests to keep the API stable and fair for every integration.

<Info>
  Never use extra accounts, extra API keys, bots, proxies, rotating IPs, or automation patterns to bypass limits. Bypass attempts may lead to limited, suspended, or revoked keys.
</Info>

## Plan limits

| Plan    | API keys | Premium keys | Daily requests | Pacing               |
| ------- | -------: | -----------: | -------------: | -------------------- |
| Premium |       10 |           10 |          2,500 | 1 request per second |

<Note>
  Staff-issued support keys and approved partner overrides may have custom limits. The response headers are the source of truth for your active quota.
</Note>

## Headers

Dock sends standard rate-limit headers on authenticated API requests.

<ResponseField name="X-RateLimit-Limit" type="number">
  Current short-window pacing limit.
</ResponseField>

<ResponseField name="X-RateLimit-Remaining" type="number">
  Remaining requests in the short-window bucket.
</ResponseField>

<ResponseField name="X-RateLimit-Reset" type="unix timestamp">
  Time when the short-window bucket resets.
</ResponseField>

<ResponseField name="X-RateLimit-Limit-Day" type="number">
  Daily request limit for the authenticated key.
</ResponseField>

<ResponseField name="X-RateLimit-Remaining-Day" type="number">
  Remaining requests in the daily bucket.
</ResponseField>

<ResponseField name="Retry-After" type="seconds">
  Present on `429` responses. Wait at least this many seconds before retrying.
</ResponseField>

## Verification-session limits

Verification sessions have extra guardrails because clients often poll for completion.

| Limit                 | Value                      |
| --------------------- | -------------------------- |
| Session lifetime      | 5 minutes                  |
| Create-session burst  | 6 sessions                 |
| Create-session refill | 1 session every 10 seconds |
| Minimum poll interval | 2 seconds                  |
| Long-poll wait max    | 25 seconds                 |
| SSE stream max        | 30 seconds                 |
| Premium poll limit    | 150 polls per session      |

<Tip>
  Prefer `GET /api/v1/verify/session/:sid?wait=25` or `GET /api/v1/verify/session/:sid/stream` instead of polling in tight loops.
</Tip>

## Handling 429 responses

<CodeGroup>
  ```javascript JavaScript theme={null}
  async function requestWithBackoff(url, options, attempts = 5) {
    for (let attempt = 0; attempt < attempts; attempt += 1) {
      const response = await fetch(url, options);

      if (response.status !== 429) {
        return response;
      }

      const retryAfter = Number(response.headers.get("Retry-After") || 1);
      await new Promise((resolve) => setTimeout(resolve, retryAfter * 1000));
    }

    throw new Error("Rate limited after maximum retries.");
  }
  ```

  ```python Python theme={null}
  import time
  import requests

  def request_with_backoff(url, **kwargs):
      for _ in range(5):
          response = requests.get(url, **kwargs)
          if response.status_code != 429:
              return response

          retry_after = int(response.headers.get("Retry-After", "1"))
          time.sleep(retry_after)

      raise RuntimeError("Rate limited after maximum retries.")
  ```
</CodeGroup>

## Acceptable use

Do not:

* Use multiple keys, accounts, bots, proxies, or rotating IPs to avoid limits.
* Scrape, automate, or repeatedly call endpoints in a way intended to bypass quotas or access controls.
* Continue retrying aggressively after `429` responses.
* Share API keys with untrusted parties.
* Disrupt, overload, reverse engineer, resell, or sublicense Dock services.

For the full policy, read the [Terms of Service](https://docksys.xyz/terms) and [Privacy Policy](https://docksys.xyz/privacy).