Skip to main content
The default project policy is 60 requests per minute and 100,000 tokens per minute. Rate-limit responses use HTTP 429, include rate_limit_exceeded, and expose limit, remaining, and reset headers. A project can monitor a monthly budget or enforce a hard limit. A hard limit rejects new billable requests after recorded monthly estimated spend reaches the configured amount.

​
Security checklist

  • Keep keys on the server.
  • Use separate test and live credentials.
  • Apply least privilege and model or endpoint restrictions.
  • Configure an appropriate budget.
  • Monitor logs and audit activity.
  • Revoke exposed or unused keys immediately.
Policies can differ by project or organization. Read response headers instead of hard-coding the default limits.