OneSignal · Rate Limits

Onesignal Rate Limits

OneSignal publishes two independent limit systems that are easy to confuse and have very different consequences. API rate limits are per app and per endpoint and return 429 with Retry-After; they only throttle. Application message limits count delivered messages in a rolling 15-minute window and, when exceeded, temporarily DISABLE the app. Only the second one can take a customer offline.

Onesignal Rate Limits is the machine-readable rate-limit profile for OneSignal on the APIs.io network, in the API Commons Rate Limits shape.

It captures 6 rate-limit definitions, measuring messages delivered, not API requests.

Limit state is signalled in the request, response, and note response headers, and an exhausted limit returns HTTP 429.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled, server_error, and non_retryable.

Tagged areas include Notifications, Push, Email, SMS, and Rate Limiting.

6 Limits Exhausted: HTTP 429 requestresponsenote
Transcribed from the provider's documentation on 2026-08-13 — documentation.onesignal.com/reference/rate-limits.
View Source
NotificationsPushEmailSMSRate LimitingQuotasThrottling

Limits

Create message / Cancel message per app, per endpoint
· per second
6000/second
Create and cancel share one bucket regardless of method: 3,000 creates + 3,000 cancels = 6,000 req/sec on a paid plan. Each request can target many users or segments, so high volume should mean fewer requests with larger audiences, not more requests.
Create custom events per app, per endpoint
rate-limited independently from Create Message; exact rate not published
Create, update or delete users and subscriptions per app
· per second
1000/second
View endpoints (messages, templates, users) per app
· per second
1/second
Message History and CSV exports per app
keep parallel exports under 100 GB per file
Application message limit (app disablement) per app
messages delivered, not API requests · per 15 minutes, rolling
10x the app's total subscribed Subscriptions/15 minutes, rolling
An app with 1,000 subscribed Subscriptions may deliver up to 10,000 messages in any rolling 15-minute span. This is the ONLY limit that can disable an app; 429s never do.

Policies

Simple retry strategy
Wait 100 seconds before retrying (aligned with the maximum API response timeout). Retry up to 3 total attempts (original + 2 retries). Always reuse the same idempotency_key.
Time-sensitive retry strategy
Exponential backoff with jitter (2s, 4s, 8s, up to 60s). Cap at 10 total attempts and stop after 10-15 minutes. For 429s: wait max(Retry-After, backoff).
Retry classification
Retriable: network timeouts, no response, 429, 5xx. Non-retryable: 400, 401, 403 — these are input, authentication or permission problems, not temporary failures.
Idempotency on retry
Never retry a message send without an idempotency_key. Reuse the SAME key for every attempt. See conventions/onesignal-conventions.yml.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/onesignal-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.