Bitwarden · Rate Limits

Bitwarden Rate Limits

Bitwarden documents that its Public API throttles abusive traffic and returns 429 Too Many Requests when the API is hit too quickly. Numeric per-second ceilings are not exhaustively published. List endpoints exceeding 50 results return a continuationToken for pagination. Identity tokens issued via client_credentials are valid for 3600 seconds and should be reused rather than reissued on every call. Two cloud regions exist - api.bitwarden.com (US) and api.bitwarden.eu (EU) - each with its own identity host.

Bitwarden Rate Limits is the machine-readable rate-limit profile for Bitwarden on the APIs.io network, in the API Commons Rate Limits shape.

It captures 3 rate-limit definitions, measuring requests, items, and seconds.

An exhausted limit returns HTTP 429.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled and unauthorized.

Tagged areas include Security, Password Manager, Open Source, Vault, and Identity.

3 Limits Exhausted: HTTP 429
Method: generated, dated 2026-05-08.
Written by API Evangelist on 2026-05-08 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
SecurityPassword ManagerOpen SourceVaultIdentityRate LimitingThrottling

Limits

Public API Throttle client
requests · minute
dynamic
Bitwarden returns 429 Too Many Requests when the Public API is called too rapidly. Numeric ceiling is not published.
Pagination Window list_endpoint
items · page
50
Lists exceeding 50 results return a continuationToken; clients must page using the token to retrieve the full result set.
Identity Token Validity token
seconds · token_lifetime
3600
Bearer tokens issued from /connect/token are valid for 3600 seconds; reuse the token until expiry rather than re-issuing per request.

Policies

429 Throttling
When throughput is excessive the Public API returns 429 Too Many Requests. Clients should back off before retrying.
Token Reuse
Cache the bearer token for its 3600-second lifetime. Re-issuing per call wastes identity quota and risks rate limiting on /connect/token.
Continuation Pagination
Use continuationToken to walk lists exceeding 50 results; do not synthesise offsets.
Regional Selection
Use api.bitwarden.com / identity.bitwarden.com for US tenants and api.bitwarden.eu / identity.bitwarden.eu for EU tenants.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/bitwarden-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.