Rate limits

Per-key, per minute; your limit is configurable. Unauthenticated requests get a deliberately tiny per-IP budget. On 429, honour Retry-After and back off exponentially with jitter.

Separately, there is a daily cap on address creation. Every address we mint must be watched forever, so this is metered independently of request rate. Cache addresses on your side; do not call POST /v1/wallets on every page load — it is idempotent, but it still counts.