Safeguard
Developer Tools•

API rate limits explained: RPM, ITPM, OTPM and token buckets

Rate limits cap requests and tokens per minute, separate from your spend. Learn RPM, input and output token limits, token buckets and how to handle a 429.

Safeguard Security Team
3 min read

A rate limit caps how fast you can call an API, not how much you can spend. LLM providers usually limit requests per minute and tokens per minute, and answer with an HTTP 429 when you exceed one. Anthropic splits tokens into input and output limits, and its docs say capacity refills continuously like a token bucket.

The three common limits

Anthropic's rate limit documentation, read on 19 October 2026, measures the Messages API in:

  • RPM, requests per minute.
  • ITPM, input tokens per minute.
  • OTPM, output tokens per minute.

Exceeding any one returns a 429 that says which limit was hit. Google's Gemini documentation lists requests per minute, input tokens per minute and requests per day, and says exceeding any one triggers an error even if the others are fine.

Scope: who shares the limit

Anthropic enforces limits at the organization level, and you can set lower limits on workspaces. The Gemini documentation says limits apply per project, not per API key. Two keys in one project share one budget.

Token buckets, not fixed windows

Anthropic says it uses the token bucket algorithm, so capacity is continuously replenished up to your maximum rather than reset at fixed intervals. It also notes that a limit of 60 RPM might be enforced as 1 request per second, so short bursts can trigger errors even when your per minute average looks fine.

A numbers example

For Claude Sonnet 5.5, the Anthropic page listed these standard limits on that date:

TierRPMITPMOTPM
Start1,0002,000,000400,000
Build5,0005,000,0001,000,000
Scale10,00010,000,0002,000,000

Limits are maximums, not guarantees, and new organizations may start in a lower evaluation tier. Check your console for your own numbers.

Handling a 429

  • When the response carries a retry-after header, wait that many seconds. Earlier retries fail.
  • Back off with growing delays and add jitter so many clients do not retry together.
  • Ramp traffic up gradually. Anthropic documents acceleration limits that can trigger 429s after a sharp increase.
  • Not every 429 is a rate limit. A spend cap also returns 429 and has no retry-after header. See API spend caps and usage tiers.

Cached tokens

For most Claude models, only uncached input counts toward ITPM. Anthropic's example says that with a 2,000,000 ITPM limit and an 80 percent cache hit rate you could process 10,000,000 total input tokens a minute. This is a second reason to cache stable prompts. See prompt caching explained.

Anthropic also says max_tokens does not factor into OTPM calculations, because OTPM counts the tokens actually generated.

Quick check

Do rate limits and spend limits mean the same thing?

No. A rate limit is about speed over short periods. A spend limit is a monthly money cap. They produce different errors and different fixes.

How do I find my limits?

In your provider's console. Anthropic also documents response headers that report the limit, remaining amount and reset time.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.