Rate Limits & Idempotency
Idempotency keys
Pass an Idempotency-Key header on POST /api/v1/merchant/payments to make retried requests safe. If a request with the same key already succeeded, the original response is returned instead of creating a duplicate payment.
bash
curl https://binkpay.net/api/v1/merchant/payments \
-H "Authorization: Bearer <dashboard session token>" \
-H "Idempotency-Key: order-1042-attempt-1" \
-d '{ "amountMinor": "5000", "currency": "EGP" }'Keys are scoped per company — reuse is safe across different merchants but will short-circuit a genuine retry within your own account, so key it to something unique per attempt (e.g. your own order ID plus attempt number).
Limits
| Parameter | Type | Required | Description |
|---|---|---|---|
| Standard API requests | per authenticated user | Optional | 600 requests / minute by default. |
| Login | per IP | Optional | 10 requests / 15 minutes in production. |
| OTP request | per identifier | Optional | 10 requests / 5 minutes in production (higher in sandbox). |
| OTP verify | per identifier | Optional | 20 requests / 5 minutes in production. |
| Developer API key | per key | Optional | 1,200 requests / minute — a best-effort, in-memory ceiling on the API-key-authenticated developer probe, not shared across server instances. |
429 responses include Retry-After
When throttled, the response includes a Retry-After header (seconds). Respect it rather than retrying immediately — repeated immediate retries extend the throttle window.
Was this page helpful?