# Rate limits

Each key, and each signed-in person, has its own bucket of requests: **120 requests of burst, refilled at 2 per second.**

Every request spends one, however malformed it is, because the bucket is spent while the credential is checked and before anything else is read.

A request made with an empty bucket is refused:

```
429 Retry-After: 3
{"error":{"code":"limited","message":"Rate limit exceeded; retry after 3s"}}
```

Wait the number of seconds `Retry-After` names, then try again. The `mdbrain` CLI exits with code `4` on this answer, so a script can tell it from every other refusal.