Rate Limits

Rate limits protect shared capacity and keep a single key from starving a desk. Limits apply per API key and, independently, per project. The tighter window is enforced.

Defaults

Token windows count prompt plus completion tokens on cache misses. Cache hits count as one request and zero provider tokens.

Configure

PUT /v1/projects/prj_legal_001/rate-limits
Authorization: Bearer eridian_sk_...

{
  "requests_per_minute": 300,
  "tokens_per_minute": 500000,
  "burst": 50
}

Required scope: governance:manage

Response Headers

Every response, including errors, includes:

X-Eridian-RateLimit-Limit: 300
X-Eridian-RateLimit-Remaining: 247
X-Eridian-RateLimit-Reset: 1718400060
X-Eridian-RateLimit-Resource: requests

When the token window is the binding constraint, X-Eridian-RateLimit-Resource is tokens.

429 Body

{
  "error": {
    "type": "eridian.error",
    "code": "rate_limit_exceeded",
    "message": "Key key_8f3a2b1c exceeded 300 requests per minute.",
    "request_id": "axm_req_8f3a2b1c"
  }
}

Wait until X-Eridian-RateLimit-Reset (Unix seconds) before retrying. SDKs honor this by default.

Burst

burst allows short spikes above requests_per_minute using a token bucket. Burst does not raise the token window. Enterprise desks that batch overnight evals should raise tokens_per_minute rather than relying on burst.

Interaction with Budgets

A 429 rate_limit_exceeded is a windowing event. A 429 budget_exceeded is a monthly hard stop. Do not treat them as the same incident. See Runbooks.

TypeScript

import { Eridian, RateLimitError } from "@eridian/sdk";

const client = new Eridian({ apiKey: process.env.ERIDIAN_API_KEY!, maxRetries: 5 });

try {
  await client.inference.create({
    model: "auto",
    projectId: "prj_legal_001",
    messages: [{ role: "user", content: "Extract covenants." }],
  });
} catch (error) {
  if (error instanceof RateLimitError) {
    console.error("retry after", error.resetAt);
  }
  throw error;
}

See Errors and Authentication.