Rate Limits & Abuse Policy

To protect shared edge resources and ensure consistent low latency for all users, the Open Graph Image Generator applies rate limits on anonymous traffic.

---

Quotas & Anonymous Limits

The following limits apply to unauthenticated public API requests:

Resource / Endpoint	Quota Limit	Enforcement Window
Image Generation (/v1/images/*)	60 requests / minute	Per IP address (Sliding minute window)
Daily Render Quota	1,000 requests / day	Per salted IP hash (24-hour UTC window)
Global Anonymous Ceiling	50,000 requests / day	Shared global capacity pool
Developer Tools (/v1/tools/*)	20 requests / minute	Per IP address
Render Execution Timeout	8,000 ms (8 seconds)	Maximum wall-clock rendering deadline

---

HTTP 429 Rate Limited Response

When your client exceeds a quota limit, the API returns an HTTP 429 response accompanied by a standard Retry-After header indicating how many seconds to wait before retrying:

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 45
x-request-id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please slow down.",
    "request_id": "9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"
  }
}

Best Practices for Handling Rate Limits:

• Inspect Retry-After: Read the Retry-After header and delay your next request by that duration.
• Implement Exponential Backoff: When making automated batch requests or building static sites, incorporate exponential backoff with jitter.
• Leverage Edge Caching: Ensure you are not bypassing edge caching with randomized tokens or unique queries on every hit. Repeated identical requests hit the edge cache and do not count against your render quota.

---

Privacy-Preserving IP Hashing

We take privacy seriously. Client IP addresses are never logged or stored in plain text:

1. Incoming requests have their IP address combined with an internal, securely generated salt (IP_HASH_SALT).
2. The salted combination is passed through a cryptographic SHA-256 hash function.
3. Only the truncated hash digest is used as the rate-limiting key in edge memory.
4. Salts rotate automatically, preventing long-term profiling or cross-service tracking.

---

High Volume & Production Needs

If your application generates tens of thousands of dynamic images daily or requires custom dedicated rate limits, check our Pricing & Roadmap to register your interest for API keys and enterprise tier availability.