A 429 Too Many Requests means a server counted your requests and refused the next one. The standard behind it, RFC 6585, leaves the counting to the server: "this specification does not define how the origin server identifies the user, nor how it counts requests." That gap decides the fix. GitHub counts your address when you send no token and your account when you do. Discord counts the bot's token. OpenAI and Anthropic count the organization, and both also answer 429 when the money runs out.
We read the standards, the documentation of nine services that send or handle 429, the terms of three platforms and five other guides on October 13, 2026, all from our server. We also captured a 429 ourselves and ran the Python code below once. No request went through a proxy.
How do you fix a 429 Too Many Requests error?
Find out what was counted, then wait the way the server asks. A 429 about credits or a spend cap ends only when the account changes, so retrying it wastes time. A speed limit ends when its window does. Obey Retry-After when it arrives, and otherwise back off with jitter and a cap on attempts. A 429 on the very first request often means someone else used up the allowance of an address you share.
Read who counted
the body and headers name an address, a token, an account or a project
Billing or quota?
credits, spend caps and usage limits end only when the account changes
Retry-After sent?
wait exactly that long, in seconds or until the date
No header
back off with jitter, and cap the tries and the total time
Refused on the first try?
check who else shares your address
What a 429 means, and who sends it
RFC 6585, published in April 2012, defines the code: "The 429 status code indicates that the user has sent too many requests in a given amount of time". The response may carry a Retry-After header, and it "MUST NOT be stored by a cache". MDN adds that limits may be "server-wide or per resource".
Not every limit answers 429. RFC 6585 itself says "servers are not required to use the 429 status code". nginx, a common web server, rejects rate-limited requests with 503 unless its limit_req_status setting says otherwise, and it allows no burst by default. GitHub answers a spent limit with "a 403 or 429 response". On Cloudflare, a site's rate-limiting rule blocks with 429 by default, and Cloudflare's help pages call the same block error 1015: "You are being rate limited".
Who counted your requests
The fix depends on the key the server counts. Most APIs count a credential, and then the address you send from changes nothing.
Who counts your requests
| Service | What it counts | Its limit |
|---|---|---|
| GitHub, no token | Your address | 60 an hour |
| GitHub, with a token | Your account | 5,000 an hour |
| Discord bot | The bot token | 50 a second |
| Discord, no token | Your address | 50 a second |
| OpenAI API | Organization and project | By model and tier |
| Claude API | Organization | By usage tier |
| Cloudflare rule | What the site picks | Set by the site |
| nginx limit_req | What the site picks | Set by the site |
GitHub, Discord, OpenAI, Anthropic, Cloudflare and nginx documentation, read October 13, 2026
GitHub is the clearest case. "Unauthenticated requests are associated with the originating IP address", and the limit is 60 requests an hour. With a token, requests count against your account, at 5,000 an hour. Discord identifies callers by their token and falls back to the address only when a request carries none. OpenAI writes that "Rate limits are defined at the organization level and at the project level", and Anthropic's limits "are set at the organization level".
Websites choose their own key. A Cloudflare rule can count by address, or by a cookie-based visitor ID for people behind one NAT address. It can also count by a header, cookie or query value, by network (ASN), by country, or by the TLS fingerprint called JA3 or JA4. nginx counts whatever its configuration names, often the client address. So the same client can meet a limit that follows its address on one site and its login on the next.
The 429s that waiting does not end
The most-viewed 429 question on Stack Overflow concerns OpenAI: "You exceeded your current quota, please check your plan and billing details", with 488,370 views on October 13, 2026. That message is about money. OpenAI's error codes list several 429s of this kind, and its documentation is plain about them: "Retrying billing, spend, or quota errors won't restore API access." Anthropic's monthly spend cap works the same way. Its 429 "has no retry-after header and keeps failing until access resumes". Access resumes at 00:00 UTC on the first day of the next month, unless the organization moves to a higher tier sooner.
The 429s that waiting does not end
| Service | What the 429 says | What ends it |
|---|---|---|
| OpenAI | Credit balance exhausted | Adding credits |
| OpenAI | Project spend limit reached | Raising the limit |
| OpenAI | Organization usage limit reached | A higher approved limit |
| Claude API | Monthly spend cap reached | Next month, or a higher tier |
OpenAI error codes; Anthropic API errors and rate limits; read October 13, 2026
Read the message before you build a retry loop. A billing 429 names credits, a spend limit or a usage limit, and a loop around it only burns time.
How long to wait: Retry-After and the limit headers
RFC 9110 gives Retry-After two forms: a number of seconds, or an HTTP date. "Retry-After: 120" means two minutes. MDN warns that support for the header "on both clients and servers is still inconsistent", so read it yourself when your client does not.
Many APIs say more. GitHub sends the limit, what remains, what is used and when the window resets, in its x-ratelimit headers. Its GET /rate_limit call shows them, and "Calling this endpoint does not count against your primary rate limit". We called it from our server on October 13, 2026. An address with no token gets 60 requests an hour, and none were used.
Discord sends a JSON body with a retry_after field and an X-RateLimit-Scope header. A 429 with the scope shared concerns a resource many callers use, and Discord does not count it against you. An IETF draft, in an editor's copy of April 18, 2026, would give every server the same two headers. RateLimit-Policy states the quota, as in "default";q=100;w=10, and RateLimit states what is left, as in "default";r=50;t=30.
Waiting the right way: backoff, jitter and a cap
Without a Retry-After, the client has to choose the wait. curl retries only when asked with --retry, and it treats 429 as a transient error along with 408, 500, 502, 503, 504, 522 and 524. It "first waits one second and then for all forthcoming retries it doubles the waiting time until it reaches 10 minutes". A Retry-After from the server overrides that, since curl 7.66.0. Our capture above shows the first two waits: 1 second, then 2.
Python's requests library "does not retry failed connections" by default. Its retries come from urllib3's Retry class. Retry honors Retry-After on 413, 429 and 503 out of the box, but it backs off only when you set a backoff factor:
import requests
from requests.adapters import HTTPAdapter
from urllib3.util import Retry
retry = Retry(
total=5, # at most five retries
status_forcelist=[429, 503], # retry these codes
backoff_factor=1, # waits 0, 2, 4, 8, 16 seconds
backoff_jitter=1.0, # plus up to 1 second at random
) # Retry-After is honoured by default
session = requests.Session()
session.mount("https://", HTTPAdapter(max_retries=retry))
r = session.get("https://api.github.com/rate_limit", timeout=10)
print(r.status_code, r.headers.get("x-ratelimit-remaining"))
We ran this once on our server, with requests 2.31.0 and urllib3 2.0.7. GitHub answered 200 with 60 requests remaining. Pointed at a test address that always answers 429 with two retries allowed, the same session gave up after 3.6 seconds with a RetryError: "too many 429 error responses". Catch that error, or the script stops there.
The jitter matters. In AWS's 2015 simulation of 100 clients competing for the same work, adding random jitter to exponential backoff cut the number of calls by more than half. Google's Cloud Storage library for Python starts at 1 second, doubles, waits at most 60 seconds between tries and gives up after 120. Cap yours the same way. OpenAI counts unsuccessful requests against your per-minute limit. Discord temporarily restricts an address after 10,000 invalid requests (401, 403 or 429) in 10 minutes. GitHub warns that requests sent while limited "may result in the banning of your integration".
For crawling a site, Wikimedia's API etiquette gives the simplest pace there is: "Make your requests in series rather than in parallel". It also asks for a User-Agent with contact details, "or you may be IP-blocked without notice".
A 429 on the very first request
Another classic Stack Overflow question asks why a simple query to Google from Python returns 429 (44,676 views). When your own count is zero, someone else's may be full. RFC 6269, on addresses shared by many users, describes one user who "may block out other users who have not made any previous attempts but who will now fail on their first attempt". Cloudflare warns that visitors behind one NAT address can "share a single counter bucket". Google says its unusual-traffic message can come from others "that use the same Virtual Private Network (VPN) you use" or the same internet provider.
Addresses shared with strangers include VPN exits, free proxies, mobile carriers that put many phones behind one address (CGNAT), and office or school networks. Two checks tell the cases apart. First, look for anything of yours in the response: GitHub's x-ratelimit-resource names the bucket you used, and Discord's scope says user, global or shared. Second, for an API, authenticate. GitHub's own advice for a higher limit is to make authenticated requests, which move the count from the address to your account.
The rules on getting around a limit
The platforms write their limits into their terms. X's developer policy says: "You may not exceed or circumvent rate limits, or any other limitations or restrictions described in this Policy". Reddit's developer terms allow suspension when Reddit believes "that you have attempted to circumvent" its limits, and they send "research in excess of rate limits" to a separate agreement. GitHub's terms say "You may not share API tokens to exceed GitHub's rate limitations" and allow suspension of API access for excessive requests.
The higher limits these platforms offer go through the front door. GitHub raises its limit for authenticated requests, GitHub Apps and Enterprise Cloud. OpenAI moves an organization up its usage tiers as its credit purchases grow, and Anthropic moves organizations to higher tiers over time. Discord invites bots that are banned repeatedly in normal operation to ask its support about a higher global limit.
What other 429 guides say
We read five pages that rank for the question. Hostinger, updated in September 2026, says a 429 "often happens when a website's traffic exceeds its server capacity". RFC 6585 ties the code to one user's requests, and an overloaded service is what a 503 reports. Kinsta writes that a 429 "always means the same thing", someone "overwhelming your server with too many requests". OpenAI's billing 429s overwhelm nothing. SiteLock gives sound advice on waiting a minute or two when no header arrives, and it leaves out shared addresses.
Two pages from scraping and proxy sellers point the other way. Scrapfly recommends "proxy rotation and IP address distribution to bypass IP-based rate limiting", and spreading requests across "authentication tokens" too. Massive writes that a rotating pool "distributes requests across multiple exit nodes, preventing any single IP from getting rate-limited". Both describe staying under a count by adding addresses or tokens. Where the limit counts a token or an account, that advice fails, and on X, Reddit and GitHub it runs into the terms quoted above.
Where HProxy fits
No proxy raises a limit that counts a token, an account or an organization. One case has a proxy answer: a site that counts by address, reached from an address you share with strangers. An address only you use carries only your requests. HProxy's static ISP proxies give you one dedicated address you hold, at $2.70 per IP a month. Datacenter addresses come dedicated or shared by a few users, chosen per order. The proxy checker shows which address a site sees. A new address starts with an empty count and fills it at the same pace, so the site's limit still applies to you.
Three of our pages go deeper on single services: LLM API rate limits, Janitor AI's error 429 and X's rate limit message. Are free proxies safe shows why a free address, shared by design, is the worst place to start.
What we could not find out
- Which key a given site counts. Cloudflare and nginx leave that to each site, and few sites publish it.
- How often each cause occurs. No one publishes a count of 429s by cause.
- Reddit's own request limit. Its help center answered our server with a bot check.
- OpenAI's terms on rate limits. Its terms page refused our server, so this page quotes only its documentation.
- How the RateLimit headers will end up. The IETF text is still a draft.
- What a proxy does to any of these limits. We sent no request through a proxy for this page.
Our next check of these pages is due by April 13, 2027.
Sources
Every page below was read on October 13, 2026, from our server. A date in brackets is the one the page itself carries.
- IETF: RFC 6585, Additional HTTP Status Codes (April 2012).
- IETF: RFC 9110, HTTP Semantics, Retry-After (June 2022).
- IETF: RFC 6269, Issues with IP Address Sharing (June 2011).
- IETF HTTPAPI working group: RateLimit header fields for HTTP (editor's copy, April 18, 2026).
- MDN: 429 Too Many Requests and Retry-After.
- nginx: ngx_http_limit_req_module.
- Cloudflare: rate limiting parameters and error 1015 (updated May 14, 2026).
- AWS: API Gateway throttling and Exponential Backoff And Jitter (March 4, 2015).
- GitHub: rate limits for the REST API and Terms of Service (effective April 27, 2026).
- Discord: rate limits.
- OpenAI: rate limits and error codes.
- Anthropic: API errors and rate limits.
- X: Developer Policy.
- Reddit: Developer Terms (last revised March 24, 2026).
- MediaWiki: API etiquette.
- Google: unusual traffic from your computer network and Cloud Storage retry strategy.
- curl: the manual, --retry.
- urllib3: Retry (2.8.0). Requests: developer interface (2.34.2).
- Stack Overflow: OpenAI API error 429 and error 429 with a simple query on Google, found among the highest-voted questions with 429 in the title through its public API.
- Google Keyword Planner: worldwide monthly averages, pulled October 13, 2026.
- Guides we judged, read the same day and deliberately left unlinked: Hostinger, Kinsta, SiteLock, Scrapfly and Massive.
