Verified: IP-based rate limiting
The following paths are rate-limited per client IP address at 30 requests per 60 seconds (verified in platform API rate-limit configuration):| Path pattern | Applies to merchant API |
|---|---|
POST /v1/invoices | Yes |
POST /v1/integration/woocommerce/connect | Yes |
POST /v1/integration/woocommerce/disconnect | Yes |
/v1/checkout/* | No (checkout session — browser-facing) |
POST /v1/public/payment-links/*/checkout | No (browser-facing) |
/v1/auth/* | No (not public merchant API) |
Unverified: per-API-key rate limits
No per-API-key rate limit configuration was found in the audited public merchant API source. Limits above apply to IP address only. If your integration shares an egress IP with other clients, coordinate request volume accordingly.