Skip to main content

Rate Limits & Quotas

Understand rate limits and quotas for your Toggly plan.

Rate Limits​

Toggly implements rate limiting on the Management API to protect the platform from abuse and ensure fair usage across all customers.

SDK Feature Evaluations Are NOT Rate Limited

Rate limits only apply to management API operations (creating applications, managing feature flags, updating settings, etc.). Feature flag evaluations through SDKs are NOT subject to these rate limits - your production applications can evaluate feature flags without worrying about hitting rate limits.

Management API Rate Limits​

Rate limits are applied per minute and vary based on authentication:

  • Anonymous Endpoints: 60 requests per minute with a queue limit of 10 requests
  • Authenticated Endpoints: 200 requests per minute with a queue limit of 20 requests
  • Global Default: 100 requests per minute per client (identified by IP address or user ID)
  • Authentication Endpoints: No rate limits (to prevent OIDC correlation failures)

These limits apply to operations such as:

  • Creating or deleting applications
  • Creating, updating, or deleting feature flags
  • Managing team members and permissions
  • Updating workspace settings
  • Accessing metrics and audit logs
Enterprise Rate Limits

Enterprise customers can request higher rate limits tailored to their use case. Contact [email protected] to discuss your requirements.

SDK Feature Evaluations (No Rate Limits)​

Feature flag evaluations through Toggly SDKs are not rate limited. SDKs are optimized for production use:

  • Built-in Caching: SDKs cache feature flag definitions locally
  • Local Evaluation: Feature flags are evaluated locally on your server or client
  • Configurable Polling: Server-side SDKs poll for updates at configurable intervals (default: 5 minutes)
  • No API Calls Per Evaluation: After initial fetch, evaluations happen locally without API calls

Quotas​

Feature Flags​

  • Free Plan: Unlimited
  • Pro Plan: Unlimited
  • Enterprise Plan: Unlimited

Experiments​

  • Free Plan: 3 active experiments
  • Pro Plan: 20 active experiments
  • Enterprise Plan: Unlimited

Metrics​

  • Free Plan: 100,000 events/month
  • Pro Plan: 1,000,000 events/month
  • Enterprise Plan: Custom limits

Handling Management API Rate Limits​

429 Too Many Requests Response​

When you exceed the rate limit on management API operations, the API returns a 429 Too Many Requests HTTP status code. This typically only occurs when:

  • Programmatically creating many feature flags in quick succession
  • Bulk importing configurations
  • Running automated scripts that make many API calls
  • Using the management API in tight loops

Queue Behavior​

Toggly uses queue-based rate limiting:

  • When you reach the rate limit, additional requests are queued
  • Anonymous endpoints queue up to 10 requests
  • Authenticated endpoints queue up to 20 requests
  • Requests beyond the queue limit receive immediate 429 responses

Retry Logic for Management API​

If you're using the management API programmatically, implement retry logic with exponential backoff:

// Example: Creating feature flags via Management API
async function createFeatureFlagWithRetry(flagData, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      const response = await fetch('https://api.toggly.io/v1/features', {
        method: 'POST',
        headers: {
          'Authorization': `Bearer ${apiKey}`,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify(flagData)
      });
      
      if (response.status === 429 && i < maxRetries - 1) {
        const delay = Math.pow(2, i) * 1000; // Exponential backoff: 1s, 2s, 4s
        await new Promise(resolve => setTimeout(resolve, delay));
        continue;
      }
      
      return await response.json();
    } catch (error) {
      if (i === maxRetries - 1) throw error;
    }
  }
}

Avoiding Management API Rate Limits​

Rate limits primarily affect programmatic use of the management API. Here's how to avoid hitting them:

1. Batch Management Operations​

When using the management API to create or update multiple resources, batch them with delays:

// Instead of creating flags in a tight loop
const flags = ['feature-1', 'feature-2', 'feature-3'];

for (const flag of flags) {
  await createFeatureFlag(flag);
  // Add delay between operations
  await new Promise(resolve => setTimeout(resolve, 1000));
}

2. Use Bulk Import Endpoints​

If available, use bulk import endpoints for migrating configurations rather than individual create operations.

3. Cache Management API Responses​

When fetching configuration data (like lists of feature flags), cache the responses:

// Cache feature flag list
let cachedFlags = null;
let cacheTime = null;

async function getFeatureFlags() {
  if (cachedFlags && Date.now() - cacheTime < 60000) {
    return cachedFlags;
  }
  
  cachedFlags = await fetchFeatureFlagsFromAPI();
  cacheTime = Date.now();
  return cachedFlags;
}

4. Implement Retry Logic​

Always implement retry logic with exponential backoff when calling the management API programmatically (see example above).

5. Rate-Limit Your Own Requests​

If you're building automation that uses the management API, implement your own rate limiting:

class RateLimitedClient {
  private requestTimes: number[] = [];
  private readonly maxRequests = 100; // Stay under the 200/min limit
  private readonly windowMs = 60000; // 1 minute
  
  async makeRequest(url: string, options: any) {
    await this.waitIfNeeded();
    this.requestTimes.push(Date.now());
    return fetch(url, options);
  }
  
  private async waitIfNeeded() {
    const now = Date.now();
    this.requestTimes = this.requestTimes.filter(t => now - t < this.windowMs);
    
    if (this.requestTimes.length >= this.maxRequests) {
      const oldestRequest = this.requestTimes[0];
      const waitTime = this.windowMs - (now - oldestRequest);
      await new Promise(resolve => setTimeout(resolve, waitTime));
    }
  }
}

Best Practices​

  1. Use SDKs for Feature Evaluation: SDKs are not rate limited - use them for all feature flag checks in your applications
  2. Batch Management Operations: Add delays between management API calls when automating configurations
  3. Implement Retry Logic: Handle 429 errors gracefully with exponential backoff
  4. Cache Management Data: Cache responses from management API endpoints
  5. Contact Support: If you need higher limits for automation or CI/CD pipelines, contact [email protected]

Next Steps​