API request quota
How Mailyoto counts API requests in buckets that refill one request at a time, which actions have their own limit, and what a refused request looks like.
Updated 27 October 2026
Mailyoto counts the requests of each API key in a bucket. The bucket holds 240 requests, and each request takes one out. Spent requests come back one at a time, one every 1/4 of a second. There is no minute that starts over: a key can send 240 requests at once, then keep sending 4 a second.
Limits per key#
| Limit | Value |
|---|---|
| Requests per key | 240, shared across every endpoint, one back every 1/4 of a second |
Requests with a key we refuse (401), per IP address | 30, one back every 10 seconds |
Each key has its own bucket. An account with 2 keys can make 240 requests on each.
When an IP address runs out of refused-key requests, Mailyoto refuses its requests before it checks their keys. Requests with a valid key never count there.
Actions with their own limit#
These actions also have a bucket of their own, for each key. A request needs a request left in both buckets, the key’s and the action’s.
| Action | Limit |
|---|---|
| Delete a domain | 10 a minute |
| Resend a failed email | 20 a minute |
| Rotate a webhook signing secret | 10 a minute |
| Claim a domain another account holds | 5 a minute |
| Check a claim | 12 a minute |
To create or change many aliases at once, send them in one bulk request instead of one request each.
Headers on every response#
Each response names the buckets the request used, in 2 headers:
RateLimit-Policy: "key";q=240;w=60, "endpoint";q=10;w=60
RateLimit: "key";r=341;t=1, "endpoint";r=0;t=4| Header | What it holds |
|---|---|
RateLimit-Policy | Each bucket’s name, its size (q) and its window in seconds (w). key is the key’s bucket and endpoint the action’s. |
RateLimit | What each bucket has left (r), and the seconds until it gets one more request back (t). |
Retry-After | Seconds to wait. Sent only with 429. |
When Mailyoto refuses a request#
A refused request returns status 429 and a problem-details body, with the content type application/problem+json. It takes nothing from any bucket.
{
"code": "rate_limited",
"detail": "Request limit reached. Retry after the delay in the Retry-After header.",
"errors": [],
"status": 429,
"title": "Request limit reached",
"type": "https://mailyoto.com/api/#error-rate_limited"
}Have your code read code. The detail text is for people and can change.
Wait for the seconds in Retry-After, then send the request again. For a long job, slow down when r gets low, and no request is refused.
Dashboard sign-in and new accounts#
The sign-in page counts per IP address and per account, separately from API keys:
| Limit | Value |
|---|---|
| Sign-in attempts per IP address | 25, one back every 12 seconds |
| Sign-in attempts per account, from one IP address | 5, one back every 12 seconds |
| New accounts per IP address | 10, one back every minute |