Rate Limits

Without a key, lookups are allowed 1000 requests per day per source address. That resets daily and needs no signup.

With a key, your plan's monthly quota is the limit that matters. There is no separate per-second ceiling published for it, and the endpoints are engineered for sustained use: send what your integration needs rather than pacing it defensively.

• You may use the Database Download API for any dataset you license as much as you like.
• All other endpoints have very high and undocumented rate limits.

Reading a 429

A 429 from a lookup means one of two things, and the Retry-After header is what tells them apart:

• Retry-After present: a transient limit. Wait the number of seconds it gives and the request will go through.
• Retry-After absent: the allowance is spent. Retrying won't help until the window rolls over or the plan changes.

Retrying an absent-header 429 is the one case where backoff makes things worse rather than better, so branch on the header instead of retrying blindly. The official client libraries already do.

In general, if rate limited, try again with some exponential delay.