Rate Limits
Overview
Requests to the Yugo Payments API are rate-limited at the edge, before they reach the API. Limits protect the platform from abuse and keep one integration from affecting another.
Limits
| Traffic | Key | Limit |
|---|---|---|
API-key-authenticated endpoints, called with an X-API-Key header | the API key | 600 requests per minute |
| Everything else | the client IP address | 600 requests per minute |
Each API key has its own budget on the endpoints that require it, so the limit does not depend on how many servers or egress addresses your integration uses. Sign-in endpoints of the hosted portals have a tighter per-address limit against credential guessing; webhook callbacks Yugo sends to you are not rate-limited by this mechanism.
Exceeding a limit
Requests over the limit are rejected with HTTP 429 Too Many Requests and no body. The response comes from the edge, so it carries none of the API's usual error fields. Back off and retry: a request that got 429 was not processed, so it is safe to resend, and an idempotency key keeps the retry safe for creating resources.
Recommendations
- Keep a client-side rate limiter under 10 requests per second per API key.
- Retry
429responses with exponential backoff and jitter rather than immediately. - Consume webhooks for state changes instead of polling resource status.