The API allows 100 requests per 30 seconds from each IP address. The limit covers every /manage_api endpoint together, not each endpoint separately.
Requests over the limit get an HTTP 429 Too Many Requests response. That response comes from our network edge, so it doesn't have the usual JSON error body, and there's no Retry-After header. Check the status code, not the body.
The limit is per IP address, not per API key. If several of your services call the API through the same outbound IP, they share the limit.
Handling a 429
Wait and retry, waiting longer after each failed attempt (exponential backoff):
async function mamoRequest(url, options, attempt = 0) {
const res = await fetch(url, options);
if (res.status !== 429 || attempt >= 5) return res;
const delayMs = 2 ** attempt * 1000 + Math.random() * 250; // 1s, 2s, 4s, 8s, 16s + jitter
await new Promise((resolve) => setTimeout(resolve, delayMs));
return mamoRequest(url, options, attempt + 1);
}Retrying a request that creates something can create it twice. POST /international_payouts accepts an Idempotency-Key header, so reuse the same key when you retry it.