Algovoi Co Uk Rate Limits

The tenant gateway (api.algovoi.co.uk) publishes its limits and the runtime signal: per-tenant 300 requests per minute with a burst window of 60, per-IP 120 per minute (burst 30) on unauthenticated public endpoints, per-checkout-token 60 per minute on the checkout polling path, and 5 per hour per client IP on the two signup proxies (from the OpenAPI operation descriptions). Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (unix seconds); exhaustion returns 429 with Retry-After in seconds and the envelope {"error":"rate_limited", ...}; the errors page says the default Retry-After on 5xx is 30 seconds. The pay rail (pay.algovoi.co.uk) is metered by payment rather than rate, but its machine index publishes limits on the two free unsigned tiers — 120/min for /v1/receipt/verify and 60/min for /verify/rfc9421 — and a 1800-second challenge TTL. GET /compliance/attestation is documented as "no rate limit (cached server-side)". Observed 2026-09-19: the anonymous 401/402/422 responses on api. and pay. did NOT carry X-RateLimit-* headers (only x-trace-id on api.), so the headers are documented for authenticated tenant traffic and were not observable without a key.