Punchh · Rate Limits

Punchh Rate Limits

PAR Punchh publishes rate-limiting behaviour in prose in its API Security Guidelines, not as per-endpoint quota tables and not as response headers. The numbers below are the ones PAR actually states. Two things are published and concrete — the authentication lockout thresholds partners are told to implement and that Punchh itself enforces, and the outbound webhook retry ladder. Two things are published but unquantified — the existence of separate direct-access and partner (indirect-access) endpoint tiers with different thresholds, where the partner tier is explicitly "a much higher threshold" gated behind IP allowlisting. Per-key request quotas are shared during partner certification and are not public.

Punchh Rate Limits is the machine-readable rate-limit profile for Punchh on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 4 rate-limit definitions.

The profile also includes 3 backoff/retry policies defined and response codes documented for throttled and timeout.

Tagged areas include Rate Limiting, Loyalty, and Restaurant.

4 Limits Throttle: 429
Rate LimitingLoyaltyRestaurant

Limits

Failed authentication lockout per-IP
10 failed authentications
Password reset per-IP
10 resets
Direct-access API endpoints per-client-IP
not published
Partner (indirect-access) API endpoints per-partner, keyed on the x_true_client_ip header
not published — explicitly higher than the direct-access tier

Policies

Raise limits via the partner program
Higher throughput is negotiated through PAR partner certification and IP allowlisting, not self-service. Changing a threshold requires contacting a Punchh representative with a justification, assessed case by case.
Environment separation
Sandbox and production base URIs are issued separately by a Punchh representative. Load and security testing should target the sandbox.
Idempotency over retry
Check-ins and redemptions accept the partner's own external_uid so a retry after a throttle does not double-count loyalty activity.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/punchh-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.