Rate limits

Public Marketplace Engine API traffic is throttled to protect shared installs. The default Laravel API limiter for licensed stacks budgets approximately 600 requests per minute per authenticated user ID, or per IP when unauthenticated.

Default budget

• ~600 req/min
• Per user or IP
• HTTP 429 when exceeded

Admin support exemption

Server-side admin tooling that authenticates with a valid X-Web-Admin-Support-Key is exempt from the shared public per-IP budget (so Next.js / ops proxies do not starve customer traffic).

Endpoint-specific throttles

Some sensitive routes add tighter limits (for example shop login and selected download endpoints). Treat those as part of the install’s security posture — do not hammer auth or media download paths.

Guidance

• Cache /config and catalog responses on the client where appropriate.
• Prefer React Query / app-level caching in the official Next.js and Flutter clients.
• Enterprise installs can negotiate custom budgets — contact Acrontec.