Lora API

Rate limits are per key, not per user or per workspace. Use a separate key per integration so one integration cannot consume another’s budget.

Plan limits

The workspace plan sets the budget for every active key:

Plan	Requests per key	Window
Free	API unavailable	—
Basic	600	1 minute
Business and Enterprise	1,500	1 minute

The counter resets when its one-minute window rolls. Plan changes synchronize the cap on existing keys as well as new ones. Per-key overrides aren’t available in the settings UI.

Response headers

/v1/shortcuts, /v1/folders, and /v1/tags attach the current budget to a request that reaches your route handler, so you can self-throttle before hitting 429:

Header	Meaning
`RateLimit-Limit`	The key’s budget for the current window.
`RateLimit-Remaining`	Requests left in the current window.
`RateLimit-Reset`	Seconds until the window resets (IETF `draft-ietf-httpapi-ratelimit-headers` delta-seconds format).

No 401/402/403 from the auth layer carries these, and neither does the 429 itself — a 429 only sets Retry-After (see below). GET /v1/qr doesn’t carry these headers at all. Key-authenticated calls there count against the plan limit above; anonymous calls get a separate 60 requests/minute per-IP budget instead. That endpoint’s 429 response in the API reference has the full breakdown, including the per-IP cap on failed Bearer verification.

When you hit the limit

You get 429 Too Many Requests with a Retry-After header in seconds:

{
  "error": "Too many requests",
  "code": "rate_limit_exceeded",
  "requestId": "fra1::iad1::abc123"
}

Wait the indicated number of seconds, then retry. Add jitter so concurrent workers do not retry at once:

async function callWithRetry(url: string, init: RequestInit, attempt = 0) {
  const response = await fetch(url, init);
  if (response.status !== 429 || attempt >= 4) {
    return response;
  }
  const retryAfter = Number(response.headers.get("retry-after") ?? "1");
  const jitter = Math.random() * 500;
  await new Promise((r) => setTimeout(r, retryAfter * 1000 + jitter));
  return callWithRetry(url, init, attempt + 1);
}

Choosing a key budget

A few guidelines:

For an interactive integration like an internal tool or one-user script, use the plan limit as-is.
For background jobs and batch operations, pace the worker fleet so the combined rate for one key stays below its plan limit.
Do not embed workspace API keys in browser extensions, public widgets, or other untrusted clients. Keep keys on a trusted server and proxy requests through your backend.

Shortcuts

Tags

Folders

QR Codes

Lora API — Rate limits

Plan limits

Response headers

When you hit the limit

Choosing a key budget

​Plan limits

​Response headers

​When you hit the limit

​Choosing a key budget

Plan limits

Response headers

When you hit the limit

Choosing a key budget