Rate Limit Policies

Dynamic rate limit policies

Dynamic enforces rate limits based upon IP address, project environment, and certain endpoints to protect against attacks and to prevent abuse of Dynamic’s platform. These limits are subject to change.

Errors

Requests returning a 429 status code have been rate limited. Most return this JSON body:

{
  "error": "Too many requests. Please try again later."
}

Some endpoints return their own error shape so the response stays consistent with the rest of that endpoint’s contract. Broadcast a transaction is one of them.

Detect rate limiting from the 429 status code rather than the body. The body is not guaranteed to take either shape, and is not guaranteed to be JSON.

Responses include a Retry-After header with the number of seconds to wait. Use it instead of retrying on a fixed interval.

Rate limit categories

• IP-based rate limits
• Project environment-based rate limits
• Endpoint-based rate limits

SDK rate limits

All endpoints used by the SDK prefixed by /sdk are subject to the following limits.

• 100 requests per minute per IP
• 10000 requests per minute per project environment

In addition the following endpoints have these limits

Endpoint	Rate Limit	Paths	Limited by
Nonce	10 requests per 1 minute	/:environmentId/nonce	IP Address
Connect	10 requests per 1 minute	/:environmentId/connect	IP Address
Signin	10 requests per 1 minute	/:environmentId/verify /:environmentId/emailVerifications/signin /:environmentId/smsVerifications/signin /:environmentId/providers/:providerType/signin /:environmentId/telegram/signin /:environmentId/farcaster/signin /:environmentId/externalAuth/signin	IP Address
OTP	3 requests per 1 minute	/:environmentId/emailVerifications/create /:environmentId/emailVerifications/retry /:environmentId/smsVerifications/create /:environmentId/smsVerifications/retry	IP Address
MFA	5 requests per 1 minute	/:environmentId/users/mfa/register/totp /:environmentId/users/mfa/auth/totp /:environmentId/users/mfa/register/passkey /:environmentId/users/mfa/auth/passkey /:environmentId/users/mfa/recovery /:environmentId/users/mfa/auth/recovery	IP Address
Token balances	20 requests per 1 minute	/:environmentId/chains/:chainName/balances	IP Address
Embedded wallets (v2)	20 requests per 1 minute	/:environmentId/users/embeddedWallets /:environmentId/users/embeddedWallets/walletAccounts /:environmentId/users/embeddedWallets/sessionKey	IP Address
Update user	5 requests per 1 minute	/:environmentId/users	IP Address, User
Delete user	2 requests per 1 minute	/:environmentId/users	IP Address
Embedded Wallet Sign (v3)	30 requests per 1 minute	/:environmentId/waas/:walletId/signMessage	IP Address, User
Broadcast transaction	30 requests per 1 minute per wallet 3000 requests per 1 minute per caller	/:environmentId/waas/:walletId/transactions/broadcast	User, Wallet

Broadcast transaction limits

Broadcasting is limited per wallet rather than per IP, because every attempt costs a signing ceremony and a network submission. A caller acting for many wallets gets a separate budget per wallet, up to the caller limit across all of them.

Both limits are configurable per project environment. Email [e-mail] if your application needs a higher limit.

A rate limited broadcast returns the same shape as every other broadcast response, so you can handle it without a special case:

{
  "code": "broadcast_rate_limited",
  "error": "Too many broadcast requests for this wallet. Retry after the indicated delay.",
  "payload": {
    "attempts": 0,
    "retryable": true,
    "submissionState": "not_submitted"
  }
}

submissionState is not_submitted, so the transaction never reached the network and retrying is safe. Wait for the Retry-After delay, then send the same request again with the same idempotency key.

Server SDK rate limits

Endpoints prefixed by /server are used by server-side SDK clients (for example, the Node SDK constructed with an apiKey). These endpoints are subject to the following limits.

Endpoint	Rate Limit	Paths	Limited by
Sign message	10 requests per second	/:environmentId/waas/:walletId/signMessage	IP Address
Import private key	10 requests per second	/:environmentId/waas/privateKey/import	IP Address
Refresh	10 requests per second	/:environmentId/waas/:walletId/refresh	IP Address
Reshare	10 requests per second	/:environmentId/waas/:walletId/reshare	IP Address

Developer rate limits

All endpoints used by Developers are subject to the following rate limits.

• 1500 requests per minute per IP
• 3000 requests per minute per project environment

In addition the following endpoints have these limits

Endpoint	Rate Limit	Path	Limited by
Bulk create user	150 requests per 1 minute	/environments/:environmentId/users/bulk	IP Address
Create embedded wallet	300 requests per 1 minute	/environments/:environmentId/waas/create	IP Address
Organization invites	20 requests per 1 minute	/organizations/:organizationId/invites	IP Address
List users & visitors	300 requests per 1 minute (shared across both endpoints)	/environments/:environmentId/users /environments/:environmentId/visitors	Project environment

Webhooks

See webhooks limits for more information.