# Rate limits

URL: https://email-validation.org/docs/rate-limits/
Updated: 2026-10-20

> Documentation index: https://email-validation.org/llms.txt

Paid accounts can send up to 500 validation requests per second. Accounts that have not bought
credits yet can send up to 20 per second. Requests over the limit get `429 rate_limited` with a
`Retry-After` header, and they cost nothing.

## Limits

| | Paid accounts | Accounts without a purchase |
|---|---|---|
| Requests per second | 500 | 20 |
| Short burst | 500 | 40 |
| Requests in flight at once | no separate limit | 100 |

An account counts as paid from its first completed purchase. The limits apply per account, across all its API keys
and the MCP server. Every result from `/v1/validate` (HTTP `200`, test addresses included) carries
`X-RateLimit-Limit` with the per-second limit that applies to the key: the account's, or the key's own when it is
lower. Error answers do not carry it; a `429` carries `Retry-After` instead.

You can give a key a lower limit of its own, and a daily credit cap, in the dashboard (see
[Authentication](https://email-validation.org/docs/authentication/#limits)).

## How limits are counted

Limits work like a bucket that refills at the per-second rate and holds at most the burst size. A steady stream at
or below the rate never hits the limit; a sudden spike can use the burst, then slows to the rate.

Spread requests evenly rather than sending them in large batches every few seconds. For lists, use a
[bulk job](https://email-validation.org/docs/api/bulk/): bulk jobs are not subject to these per-second limits and schedule the work for you.

## When you hit a limit

| Code | Meaning | What to do |
|---|---|---|
| `rate_limited` | Over the per-second limit of the account or key. | Wait `Retry-After` seconds, then continue at a lower rate. |
| `key_daily_cap` | The key used its daily credit cap. | Raise the cap, use another key, or wait for the next day. |
| `abuse_throttled` | Far more requests ended without a definite answer than with one, so the account is slowed for an hour. | Stop re-checking the same failing addresses; retry them later. |

While capacity is constrained we may lower limits for a short time; you will see `429` or `503` with
`Retry-After`, and nothing is charged.

## Timeouts

A single check takes at most 15 seconds on our side; you can lower that with the `timeout` field
(5–15 seconds). A check that runs out of time returns `unknown` with the reason
`timeout` and is free. Set your HTTP client timeout to about 20 seconds.

## Dashboard and free checker

Checks from the dashboard are limited to 5 per second per account. The free email checker on
the website allows 5 checks a day from one IP address and is not meant for automation.