PUBLISHED PROVIDER LIMITS
Limits keep their provider-specific dimensions.
The Client API applies cumulative limits across Cloudflare API calls, while GraphQL and individual products can add separate controls.
Authentication: API token, Global API key
Primary scope: User, Account Token, Or Source IP
Measured dimensions: Requests, Graphql Queries, Active API Tokens
Profile coverage: Cloudflare Client API user, token, and source-IP limits, GraphQL request limits, API-token quotas, response headers, and exceeded-limit behavior. Product-specific API limits remain outside this profile.
Global limits
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Client API per user or account token | 1,200 requests | Per 5 minute | User Or Account Token | Cumulative across Cloudflare API calls |
| Client API per source IP | 200 requests | Per second | Source Ip | Published provider limit. |
Graphql Rate
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| GraphQL API maximum | 320 queries | Per 5 minute | User Or Account Token | GraphQL queries are also constrained by query cost. |
Resource Limit
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| User API token quota | 50 active tokens | At one time | User | Published provider limit. |
| Account API token quota | 500 active tokens | At one time | Account | Published provider limit. |
RESPONSE METADATA
Headers expose the applicable limit state.
RateLimitFormat: Structured Field- Current quota, remaining capacity, and reset delay for the applicable Cloudflare policy.
RateLimit-PolicyFormat: Structured Field- Cloudflare rate-limit policy details, including the quota and time window.
Retry-AfterFormat: Integer Seconds- Seconds, rounded up, until Cloudflare allows another request.
WHEN A LIMIT IS EXCEEDED
Read the response before choosing a delay.
- Rate-limit responses can use HTTP 429.
- Exceeding the Client API limit temporarily blocks Cloudflare API calls for the applicable identity.
RECOMMENDED HANDLING
Protect both the provider and your own queue.
- Read RateLimit and RateLimit-Policy on successful responses.
- Honor Retry-After after a 429 response.
- Account for GraphQL query cost and product-specific limits separately.
VERIFICATION RECORD