Both windows apply. Staying under the per-minute limit does not exempt you from
the daily quota.
Read the headers instead of guessing
Every response carries the current state, so you never have to discover a limit by being refused:429 additionally carries retry-after in seconds. Honour it — retrying
sooner just burns quota against a closed window.
Why anonymous callers should still get a key
Anonymous requests are bucketed by IP. CI runners, serverless functions, and corporate NATs share egress addresses, which means unrelated users throttle each other and you cannot tell your own traffic from theirs. A key gives you a private bucket at 5× the rate. That is the honest reason to get one, and it is why we do not need to force it.Service discovery (
GET /api/v1), the OpenAPI spec, and GET /api/v1/health sit
outside the developer quota. A caller who has just been rate-limited must
still be able to read the endpoint that explains why, and a monitoring system
polling health should not exhaust a budget shared with its neighbours.