Rate Limits

Understand API rate limiting policies and how to handle rate limit errors

Rate Limits

Daytona implements rate limiting to ensure platform stability and fair resource distribution across all users. Rate limits apply to all API endpoints based on your authentication method and request type.

Rate Limit Types

Daytona enforces different rate limits for different types of operations:

Authenticated Requests

Standard rate limit for authenticated API requests.

• Limit: 100 requests per minute
• Window: 60 seconds
• Scope: Per API key or user token

{
  "authenticated": {
    "limit": 100,
    "ttl": 60
  }
}

Failed Authentication Attempts

Protects against brute-force attacks.

• Limit: 10 failed attempts per 5 minutes
• Window: 300 seconds
• Scope: Per IP address

{
  "failedAuth": {
    "limit": 10,
    "ttl": 300
  }
}

Sandbox Creation

Limits the rate of sandbox creation to prevent resource exhaustion.

• Limit: 20 sandboxes per 10 minutes
• Window: 600 seconds
• Scope: Per organization

{
  "sandboxCreate": {
    "limit": 20,
    "ttl": 600
  }
}

Sandbox Lifecycle Operations

Limits start, stop, restart operations on sandboxes.

• Limit: 50 operations per 5 minutes
• Window: 300 seconds
• Scope: Per organization

{
  "sandboxLifecycle": {
    "limit": 50,
    "ttl": 300
  }
}

Rate Limit Headers

Every API response includes rate limit information in the headers:

X-RateLimit-Limit · number

Maximum number of requests allowed in the time window

X-RateLimit-Remaining · number

Number of requests remaining in the current window

X-RateLimit-Reset · number

Unix timestamp when the rate limit window resets

Example Response Headers

HTTP/1.1 200 OK
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 73
X-RateLimit-Reset: 1705320000
Content-Type: application/json

Rate Limit Errors

When you exceed a rate limit, the API returns a 429 Too Many Requests response:

{
  "statusCode": 429,
  "message": "Too Many Requests",
  "error": "Rate limit exceeded. Please retry after 45 seconds.",
  "retryAfter": 45
}

statusCode · number

HTTP status code (429)

message · string

Error message summary

error · string

Detailed error description

retryAfter · number

Seconds to wait before retrying the request

Response Headers on Rate Limit

HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1705320045
Retry-After: 45
Content-Type: application/json

Handling Rate Limits

Check Before Request

Monitor rate limit headers to avoid hitting limits:

import requests
import time

def make_request(url, headers):
    response = requests.get(url, headers=headers)
    
    # Check remaining requests
    remaining = int(response.headers.get('X-RateLimit-Remaining', 0))
    
    if remaining < 10:
        # Approaching limit, slow down
        reset_time = int(response.headers.get('X-RateLimit-Reset', 0))
        wait_time = reset_time - time.time()
        print(f"Approaching rate limit. Waiting {wait_time} seconds...")
        time.sleep(wait_time)
    
    return response

Implement Exponential Backoff

Retry failed requests with exponential backoff:

import requests
import time

def request_with_backoff(url, headers, max_retries=5):
    for attempt in range(max_retries):
        response = requests.get(url, headers=headers)
        
        if response.status_code != 429:
            return response
        
        # Rate limited, wait and retry
        retry_after = int(response.headers.get('Retry-After', 2 ** attempt))
        print(f"Rate limited. Retrying after {retry_after} seconds...")
        time.sleep(retry_after)
    
    raise Exception("Max retries exceeded")

Use SDK Auto-Retry

Official Daytona SDKs include automatic retry logic:

import { DaytonaClient } from '@daytona/sdk';

const client = new DaytonaClient({
  apiKey: process.env.DAYTONA_API_KEY,
  retryConfig: {
    maxRetries: 3,
    retryDelay: 1000,
    backoffMultiplier: 2
  }
});

// SDK automatically handles rate limits and retries
const sandboxes = await client.sandboxes.list();

Best Practices

Batch Operations

Use batch endpoints when available to reduce total request count:

# Instead of multiple single requests
POST /sandbox (x20)

# Use paginated listing
GET /sandbox/paginated?limit=100

Cache Responses

Cache API responses when data doesn’t change frequently:

import time

cache = {}
cache_ttl = 60  # Cache for 60 seconds

def get_sandboxes_cached(api_client):
    now = time.time()
    
    if 'sandboxes' in cache:
        cached_at, data = cache['sandboxes']
        if now - cached_at < cache_ttl:
            return data
    
    # Cache expired, fetch fresh data
    data = api_client.sandboxes.list()
    cache['sandboxes'] = (now, data)
    return data

Distribute Load

Spread requests evenly over time instead of bursting:

import time

def process_sandboxes(sandbox_ids):
    for sandbox_id in sandbox_ids:
        process_sandbox(sandbox_id)
        # Add small delay between requests
        time.sleep(0.6)  # ~100 requests/minute

Monitor Usage

Track your rate limit usage over time:

def log_rate_limit_usage(response):
    limit = response.headers.get('X-RateLimit-Limit')
    remaining = response.headers.get('X-RateLimit-Remaining')
    usage_percent = ((int(limit) - int(remaining)) / int(limit)) * 100
    
    print(f"Rate limit usage: {usage_percent:.1f}%")
    
    if usage_percent > 80:
        print("WARNING: Approaching rate limit")

Increasing Rate Limits

If your use case requires higher rate limits:

1. Review your implementation - Ensure you’re using best practices and batch operations
2. Contact support - Reach out to discuss your specific needs
3. Enterprise plans - Higher rate limits available on enterprise plans

Rate limits are configurable per organization for enterprise customers. Contact sales for custom rate limit configurations.

Checking Current Limits

Retrieve your current rate limit configuration:

curl -X GET https://api.daytona.io/config \
  -H "Authorization: Bearer YOUR_API_KEY"

Response includes rate limit configuration:

{
  "version": "1.0",
  "rateLimit": {
    "authenticated": {
      "limit": 100,
      "ttl": 60
    },
    "failedAuth": {
      "limit": 10,
      "ttl": 300
    },
    "sandboxCreate": {
      "limit": 20,
      "ttl": 600
    },
    "sandboxLifecycle": {
      "limit": 50,
      "ttl": 300
    }
  }
}

Rate Limit Exemptions

Certain endpoints may be exempt from rate limiting:

• Health check endpoints (/health, /status)
• Public configuration endpoints (/config)
• WebSocket connections (subject to connection limits)

Next Steps

Error Handling

Learn about all API error codes

SDKs

Use SDKs with built-in retry logic

Sandboxes API

Start making API requests

Monitoring

Monitor your API usage