Rate limits and best practices
| Access | Identity | Quota | Availability | | --- | --- | ---: | --- | | Anonymous | IP address | 60 requests/hour | Default, no signup | | Free beta | API key | 10,000 requests/day | All signed-in users |
Quota state is returned in the usage object. A 429 response includes Retry-After; wait at least that many seconds before retrying.
Cache intentionally
The API publishes meta.cached_at and meta.next_update. Keep the last successful payload until next_update instead of polling in a tight loop. GEX, sector rotation, and options flow update on a 25-second cache; slower official datasets such as the VIX settlement curve use longer windows.
Handle failure without hiding it
- Branch on HTTP status before reading
data. - Back off exponentially for
429and transient5xxresponses. - Add jitter when many workers refresh the same resource.
- Never replace unavailable real market data with simulated values in production.
- Keep the previous timestamp visible when displaying stale data.
Protect keys
Use X-API-Key in server-side code. Do not commit keys, embed them in public JavaScript, or put them in query strings where reverse proxies may log them. Rotate a key immediately if it appears in a repository or client bundle.
CORS
Public read endpoints allow cross-origin GET requests. API-key management is same-origin only and also requires the signed-in account token.