Rate limits & quotas

ZetPin protects the platform with two controls: a rate limit on the OAuth endpoints and a per-app monthly quota on publishing.

OAuth endpoint rate limit

The /oauth/token endpoint and the authorize decision are rate-limited to slow brute-force and credential-stuffing attempts. When you exceed the limit, requests are rejected with a “Too many attempts” response over roughly a 15-minute rolling window. Back off and retry after the window rather than hammering the endpoint.

Don't refresh in a hot loop

A crash-loop that keeps calling /oauth/token will trip this limit and lock your token exchange for the window. Cache access tokens for their full hour and refresh proactively, once, per user.

Monthly post quota

Publishing via POST /dev/v1/posts is metered per app per calendar month (default 100 posts/month; first-party and partner apps may have higher limits). Once the quota is spent, publish requests return 429 with a quota_exceeded error until the next month resets. Read endpoints are not affected.

json

// 429 Too Many Requests
{
  "error": "quota_exceeded",
  "error_description": "Monthly post quota reached for this app."
}

Reading a post you just published, listing posts, and pulling analytics do not consume the publish quota — only successful POST /posts calls do.

How usage is tracked

Usage is tracked per app, per month, in ZetPin's request telemetry — every developer API call is recorded against the app that made it. Quotas are keyed to your app's registered plan, so if you need a higher monthly limit, email developers@zetpin.com to have it raised.

Handling limits gracefully

Use exponential backoff

When you receive a 429 or a “Too many attempts” response, retry with exponential backoff and jitter — e.g. wait 1s, then 2s, 4s, 8s (plus a small random offset), capping at a sane maximum. Never retry immediately in a tight loop; that only deepens the limit and delays recovery.

Treat the monthly quota as a hard ceiling — track your own count and stop before you hit it.
Queue non-urgent publishes and spread them out rather than bursting at the start of the month.
Surface quota-exhausted states to your users instead of silently dropping their posts.

For the full 429 quota_exceeded error shape and other codes, see Errors. The base URL for all metered calls is https://api.zetpin.com/dev/v1.

PreviousErrors