Rate limits

OnlyTrade runs on a fair-use policy. There are no hard published quotas on the shared reference deployment today; instead, follow the guidance below so your integration stays well-behaved and predictable.

Fair-use guidance

Surface	Guidance
Auth (/auth/v1/oauth2/*)	Keep login/token under ~60 requests/min per IP. Cache the access_token and reuse it until it expires — don't log in per request.
Public (/api/v1/public/*)	Keep signup / password-reset under ~20 requests/min per IP.
Authenticated REST (/api/v1/*)	Batch and cache. Read reference data (symbols, groups) once and reuse; don't poll endpoints you can get from the WebSocket stream.
WebSocket (/ws/v1)	Use one connection per session and subscribe to what you need — prefer the stream over polling for prices and account updates.

Best practices

• Reuse tokens. An access token is valid for its full expires_in; refresh it rather than re-authenticating.
• Prefer the stream. Live prices, position P&L, and account/money updates are pushed over WebSocket — polling them over REST is the most common cause of excess load.
• Back off on errors. On 429/503, retry with exponential backoff and jitter.

Per-deployment limits

Because each broker runs a dedicated deployment, your operator may enable enforced per-IP limits tuned to your traffic. If hard limits are active on your deployment, exceeding them returns 429 Too Many Requests; honour the response and back off.