AppsinityAPPSINITY
APIs

Rate limits

No Appsinity service counts your requests. There is no throttle, no quota and no 429 from the application. The limits that do exist come from request size, gateway timeouts, credential lifetimes and row-fetch caps.

Open Appsinity Studio

What is not limited

MechanismStatusEvidence
Requests per IPNoneNo throttle middleware in the service
Requests per accountNoneNo per-user counter exists
Concurrent connectionsNone at the appOnly the web server and CDN shape it
Payload size per requestNot enforced for JSONSize caps apply to uploads only
Response rate 429Never returned by the appStatuses used are 200, 201, 400, 401, 403, 404, 409, 500, 502
Burst protection on loginNone documentedCredential stuffing is defended only by password policy
Daily quotaNoneNo quota state is kept
Watch out: Absence of a limit is not permission. An unbounded loop against these endpoints is your problem when it degrades the service for everyone, including your own players.

The limits that do bind

LimitValueWhere it bites
Session token lifetime30 daysLong-running automation dies mid-task
Presigned PUT expiry10,800 secondsA very slow large upload
Build upload ceiling5 GiB per objectOne file, not one build
App media ceiling250 MiB per objectA large trailer or artwork file
Gateway timeout60 secondsA synchronous sign request answers 504 while the work continues
Reviews fetched100 rowsA listing with more reviews than that
Analytics sources20 rowsLong-tail traffic origins
Country breakdown50 rowsSmall-market detail
Catalog fetch ceilinglimit=100Anyone enumerating the store
Browse and chart caps60 itemsCategory pages
Search pool100 rows, 6 shownSearch result depth
New-release window45 daysWhat counts as new
Auto-signer cycle30 secondsHow quickly a build gets signed
Licence devices2 per licenceInstall attempts beyond that
Offline grace72 hoursA machine without connectivity
OTP validity10 minutesA slow copy-paste
Note: Two of these look like rate limits and are not: the thirty-second signer cycle is a job interval, and the sixty-second gateway timeout is a proxy setting, which is why a signing call can fail with 504 and still succeed.

What overload actually looks like

  • 500s from the application when a handler throws, rather than a polite refusal.
  • 502 from the payments Worker when Razorpay itself is slow or rejects the order.
  • 504 from the gateway when a synchronous call crosses sixty seconds.
  • Silently stale reads, because the store pages and asset sheets are cached at the edge for hours.
  • Nothing that says slow down. You have to decide that yourself.
Not available: A Retry-After header is never sent, because no code path produces one. Implementing one is not the same as implementing a rate limit.

Advice, stated as advice

  1. Cache your own reads. Analytics aggregates change slowly; a daily fetch is usually enough.
  2. Poll with a cursor. Read once, compare against the last value you acted on, sleep longer when nothing moved.
  3. Never loop on 500. One retry after backoff, then surface the error. Three hundred retries of a broken handler is a self-inflicted outage.
  4. Batch through the catalogue. Fetch limit=100 once and filter locally instead of requesting per listing.
  5. Front your own traffic. If you build a mirror or a widget, cache it server-side. Players hitting your page should not each hit Appsinity.

Frequently asked questions

What is my rate limit?

None is defined or enforced at the application layer, so there is no number to exceed and no header reporting one. Practical ceilings come from payload sizes and timeouts.

I got a 429. Where from?

Not from these services. A 429 on an appsinity.com URL comes from the CDN or edge in front of it, which means your path is being throttled as abusive traffic.

Can I get a higher limit?

There is no tier, key or plan to raise. Volume agreements are a conversation with the platform, not a configuration.

Why did my sign request 504 but still work?

The gateway gave up at sixty seconds while the signing job continued server-side. Poll the listing for signingStatus rather than trusting the HTTP response.

Need help?

Developer publishing support: [email protected]
General support: [email protected]
Partnerships: [email protected]