IOTA · Rate Limits

Iota Rate Limits

Rate limits for IOTA's public shared JSON-RPC and GraphQL endpoints across Mainnet, Testnet, and Devnet networks. All public endpoints are load-balanced but subject to rate limiting. The IOTA Foundation does not publish precise numeric rate limit values for public infrastructure; the documented guidance is that public nodes are not intended for production-level applications. For production use, developers should operate their own IOTA full node or use a commercial third-party RPC provider such as Tatum, Ankr, Monochain, or GetBlock.

Iota Rate Limits is the machine-readable rate-limit profile for IOTA on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 4 rate-limit definitions, measuring requests_per_second, indexer_requests_per_second, graphql_requests_per_second, and faucet_requests.

The profile also includes 6 backoff/retry policies defined and response codes documented for throttled and blocked.

Tagged areas include Blockchain, Distributed Ledger, Web3, RPC, and Rate Limiting.

4 Limits Throttle: 429
BlockchainDistributed LedgerWeb3RPCRate Limiting

Limits

Public endpoint rate limit (per IP) ip
requests_per_second · 1s
unspecified
The IOTA Foundation operates public endpoints that are load-balanced and rate limited, but does not publish exact numeric limits. Applications that exceed unannounced thresholds will receive 429 Too Many Requests responses. Public endpoints at api.mainnet.iota.cafe, api.testnet.iota.cafe, and api.devnet.iota.cafe are shared infrastructure intended for development and testing only.
Indexer endpoint rate limit (per IP) ip
indexer_requests_per_second · 1s
unspecified
Extended API methods (iotax_* prefixed) are served by the indexer endpoints at indexer.mainnet.iota.cafe, indexer.testnet.iota.cafe, and indexer.devnet.iota.cafe. These endpoints are also load-balanced and rate limited. Rate limits are not publicly specified and may differ from full node endpoints.
GraphQL RPC rate limit (per IP) ip
graphql_requests_per_second · 1s
unspecified
The GraphQL RPC endpoints at graphql.mainnet.iota.cafe, graphql.testnet.iota.cafe, and graphql.devnet.iota.cafe are subject to their own rate limits. GraphQL query complexity limits may also apply. Exact limits are not publicly documented.
Testnet faucet rate limit ip
faucet_requests · 1d
unspecified
The testnet faucet at faucet.testnet.iota.cafe and devnet faucet at faucet.devnet.iota.cafe are rate limited to prevent abuse. Faucet limits are not publicly specified. The faucets dispense IOTA tokens with no monetary value for testing purposes only.

Policies

Use public endpoints for development only
The IOTA documentation explicitly states that all public endpoints are load-balanced and subject to rate limiting, and recommends setting up dedicated infrastructure for production-level applications to have more control and avoid rate limit constraints.
Back off on 429 responses
When a 429 Too Many Requests response is received, the client should stop sending requests immediately, implement exponential backoff with jitter, and retry after a wait period. The IOTA public endpoints do not guarantee a Retry-After header.
Use cursor-based pagination
For list methods such as iotax_getCoins, iota_getCheckpoints, and iotax_getDynamicFields, use cursor-based pagination to retrieve data in smaller pages rather than requesting large result sets. This reduces per-request processing time and response size, lowering the chance of hitting rate limits.
Prefer batch methods
Use iota_multiGetObjects and iota_multiGetTransactionBlocks instead of making individual iota_getObject or iota_getTransactionBlock calls in a loop. Batching reduces the total number of RPC round trips and lowers rate limit pressure.
Use GraphQL for complex queries
The GraphQL RPC at graphql.mainnet.iota.cafe can retrieve multiple related data types in a single query, reducing the number of JSON-RPC calls needed and improving efficiency for analytics and data pipeline use cases.
Production requires dedicated infrastructure
Public RPC endpoints are not intended for production applications. Applications serving real users should run their own IOTA full node or use a commercial RPC provider such as Tatum (tatum.io), Ankr (ankr.com), Monochain, or GetBlock to obtain guaranteed capacity, uptime SLAs, and customer support.

Sources