Concepts
Rate limits
How many requests per minute, and what that number actually means.
120 requests per minute per credential. Above that, 429 rate_limited with
a Retry-After header.
The counter lives in process memory. Because the API runs serverless, the real ceiling is per instance: treat it as a guard against a runaway loop, not as an exact quota to run right up against.
The limit applies the same to an API key, an OAuth token and the MCP connector: it is the same credential resolved down the same path.
How not to get close to it
Stop polling. If what you want to know is "did this deal close?", a webhook tells you the moment it happens and costs zero requests. Polling a list every minute costs 1,440 requests a day to find out late.
Ask for big pages. ?limit=100 is the maximum, and a page of 100 costs the
same as a page of 25.
Paginate with the cursor, not an offset. meta.next_cursor is a keyset
cursor over created_at, id: it neither skips nor repeats rows when someone
inserts a lead while you are walking the list.
Dynamic registration has its own limit
POST /api/oauth/register accepts 10 registrations per hour per IP. It is a
separate limit, also in process memory. What makes that endpoint safe is not the
counter: it is that a registration grants nothing — see
Connect an assistant.