Reference

Rate limits

Inboundr API rate limits: 5 requests per second per account, shared by REST and MCP, with rate-limit headers on every response.

Inboundr limits requests per account, not per key or per endpoint. Every authenticated call, whether a REST request or an MCP tool call, uses the same budget:

5 requests per second, per account. The REST API and the MCP server share one budget, counted against the API key's owner. Extra keys don't add capacity, because they all draw from the same account.

The limit uses a rolling one-second window, so your allowance refreshes every second.

Reading your budget on every response#

Every response tells you where you stand:

Header	Tells you
`ratelimit-limit`	The limit for the window (`5`).
`ratelimit-remaining`	Calls still available this second.
`ratelimit-reset`	Seconds until the counter refreshes.

When a call is rejected, you get a 429 response with a retry-after header (in seconds) and this body:

json

{ "error": "Maximum 5 requests per second allowed. Upgrade or contact support for higher limits." }

Staying under the limit#

Because the budget is shared, what matters isn't any single loop but everything calling Inboundr on your account at the same time.

Pace agent tool calls

An agent working through an inbox can call tools quickly. Have it make its list_emails and get_thread calls one after another rather than in parallel, and it will stay well within five per second.

Use larger pages

To read a large mailbox, raise limit (up to 100) and paginate, rather than making many small list calls at once.

Respect retry-after

On a 429, wait the number of seconds in retry-after before retrying, and wait longer if you keep hitting the limit. Because the window is one second, a short pause is usually enough.

If your workload needs a higher limit, contact support. Higher per-account limits are available for high-volume use.