Overview
To ensure fair usage and maintain system performance, the Snippets AI API implements rate limiting specifically for invalid API key attempts.Invalid API Key Block
20 invalid attempts within a rolling window will result in a 5-minute
block for that API key.
General Rate Limit
There is no general rate limit for valid API requests. You can make as many valid requests as needed without encountering rate limiting errors, provided your API key is valid and has the necessary permissions.How the Invalid API Key Block Works
This security measure helps prevent brute-force attacks on API keys:- Each API key has a counter for invalid access attempts.
- If 20 invalid attempts are detected within a short rolling window, the API key will be temporarily blocked.
- The block lasts for 5 minutes, after which the key is automatically unblocked, and the counter resets.
Invalid Attempt Criteria
An “invalid attempt” is counted when:- An API request is made with a non-existent API key.
- An API request is made with a valid API key, but it lacks the necessary permissions for the requested resource (e.g., wrong team ID).
Checking Your API Key Status
Blocked API Key Errors
When your API key is temporarily blocked due to excessive invalid attempts, you’ll receive a403 Forbidden response (or similar, depending on exact implementation):
Retry-After header with the number of seconds until the block is lifted.
Handling Invalid API Key Blocks
Exponential Backoff (Modified)
If you encounter a403 Forbidden error specifically related to an API key block, you should cease attempts for the specified Retry-After duration. If no Retry-After is provided, assume a 5-minute (300-second) wait.
Best Practices
Use Valid API Keys
Use Valid API Keys
Always ensure you are using a valid and active API key. Double-check your key and its permissions in the Snippets AI dashboard.
Handle Authentication Errors Properly
Handle Authentication Errors Properly
Distinguish between different 4xx errors. A
401 Unauthorized means a
generally invalid key, while a 403 Forbidden might indicate a temporary
block if the message specifically mentions “Too many invalid API key
attempts”.Avoid Brute-Force Attempts
Avoid Brute-Force Attempts
Do not repeatedly try invalid API keys. This will lead to temporary blocks.
Monitor Your Integrations
Monitor Your Integrations
Regularly monitor logs and error reports from your applications to quickly identify if an API key is being blocked.
FAQs
Is there a general rate limit for valid requests?
Is there a general rate limit for valid requests?
No, there is no general rate limit for valid API requests. You can make as many valid requests as your account quota allows.
What happens if my API key is blocked?
What happens if my API key is blocked?
Your API key will be temporarily blocked for 5 minutes after 20 invalid
attempts. During this time, all requests with that key will fail.
Does a blocked key consume API requests?
Does a blocked key consume API requests?
No, requests made with a temporarily blocked API key do not consume from your
API request quota. However, invalid attempts that lead to the block do count
towards the 20-attempt limit.
Can I get permanently banned for too many invalid attempts?
Can I get permanently banned for too many invalid attempts?
Repeated and excessive attempts to bypass the security block may lead to a permanent ban of the API key or even the associated workspace. We recommend resolving the underlying issue rather than repeatedly hitting the block.