# Rate limits for API users
**URL:** https://meta.discourse.org/t/rate-limits-for-api-users/63328
**Category:** Development
**Tags:** rest-api
**Created:** [May 24, 2017, 11:58pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328 "2017-05-24T23:58:41Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [May 24, 2017, 11:58pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/1 "2017-05-24T23:58:41Z")
I want to create a sister app at some point that will post topics on to the forum via an API user account - is there any info available on rate limits for this? Can we ‘trust’ certain accounts so that rate limits do not apply?
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [May 25, 2017, 2:30pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/2 "2017-05-25T14:30:44Z")
As far as I know, using an API key (generated in the admin interface) bypasses rate limits that are checked within the rails stack, e.g. limits on the number of posts.
It will not bypass the general limit on the number of requests per second enforced by `nginx`, but most likely, that won’t be a problem 🙂
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 25, 2017, 2:52pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/3 "2017-05-25T14:52:32Z")
You can explicitly bypass validations if you are using the API and API key, the limits in general will hold though.
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [May 25, 2017, 5:21pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/4 "2017-05-25T17:21:58Z")
I’m not too bothered by validations Sam, but by-passing rate limits for specific accounts could be helpful.
Does the response include the specific error code if rate limits have been by-passed? That could be helpful if there’s no chance of including an option to by-pass..
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 25, 2017, 7:49pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/5 "2017-05-25T19:49:22Z")
I kind of worry about answering questions about problems that do not exist 😊
If you hit the limits let me know and let me know what errors you are getting
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [May 26, 2017, 1:27am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/6 "2017-05-26T01:27:23Z")
I did actually hit the limit previously - we currently have 6 monthly giveaways and every night a cron runs to check whether there is a ‘bonus day’, if there is, it posts an update on the forum. What I was finding was the crons running later weren’t posting. However I’ve since changed the cron jobs to run a minute after each other. (This is fine for this situation.)
I’ll keep you posted re the other app (which will be posting via the API much more frequently) though I don’t expect this to go live for a few months yet.
---
### Author:  [@frizman21](https://meta.discourse.org/u/frizman21)
#### Post date: [January 3, 2018, 11:44pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/7 "2018-01-03T23:44:03Z")
We use discourse via API from a Rails server. Which means all the traffic coming from one IP. We have enough traffic that it hits the rate limiter. I second the need for an API exception to this rate limit.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [March 13, 2020, 4:18am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/8 "2020-03-13T04:18:51Z")
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 13, 2020, 8:31am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/9 "2020-03-13T08:31:02Z")
This might be a good one for you to comment on today @sam – are there limits for self hosters? do we have limits? how do we think about this now, since it has changed…
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 16, 2020, 3:56am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/10 "2020-03-16T03:56:21Z")
These days we have explicit global limits for API, however sometimes limits cascade.
Certain controllers introduce limits, like maximum number of topics you can create per N seconds and so on.
For trivial get requests you could lift the api rate limit way up and not hit any limits from Discourse. There are still some limits in NGINX you would have to tweak.
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [March 16, 2020, 4:04am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/11 "2020-03-16T04:04:53Z")
> [@sam](#):
>
> These days we have explicit global limits for API, however sometimes limits cascade.
How would that impact an account wanting to post new topics or posts via its API Key Sam?
> [@sam](#):
>
> For trivial get requests you could lift the api rate limit way up and not hit any limits from Discourse.
Where can we do this Sam?
I also am currently considering making a portal that will use the `discourse_api` gem to pull in a lot of data from the forum, am I likely to hit rate limits here? I would love for us to be able to by-pass any rate limits for accounts that we have marked as ‘safe’.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 17, 2020, 6:08am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/12 "2020-03-17T06:08:26Z")
I recommend reading through our rate limits here:
>
We should have documentation for various other limits floating around meta.
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [March 17, 2020, 8:14pm UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/13 "2020-03-17T20:14:04Z")
Thanks Sam, so for future reference (and anyone else searching for this in future) here are the full details:
> [@Available settings for global rate limits and throttling](https://meta.discourse.org/t/global-rate-limits-and-throttling-in-discourse/78612):
>
> Discourse ships with 3 different global rate limits that can be configured by site admins. Global per-ip rate limits These limits apply to every unique IP address that hits the Discourse application. (files that are served directly from the filesystem or the CDN are excluded) By default this rate limit is enabled, you may disable it or set it to a reporting mode. DISCOURSE\_MAX\_REQS\_PER\_IP\_MODE : default block, this rate limit applies out of the box. (other options are warn, warn+block, and n…
_I have a question about private IPs but I’ll post in the main topic. This one can probably be closed at this point as that other topic is newer._
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [March 14, 2024, 4:41am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/14 "2024-03-14T04:41:07Z")
A post was split to a new topic: [Which validations can be bypassed and how when using the API to create topics/posts](https://meta.discourse.org/t/which-validations-can-be-bypassed-and-how-when-using-the-api-to-create-topics-posts/299282)
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [March 14, 2024, 4:42am UTC](https://meta.discourse.org/t/rate-limits-for-api-users/63328/15 "2024-03-14T04:42:16Z")