Punchh · Rate Limits

Punchh Rate Limits

PAR Punchh publishes rate-limiting behaviour in prose in its API Security Guidelines, not as per-endpoint quota tables and not as response headers. The numbers below are the ones PAR actually states. Two things are published and concrete — the authentication lockout thresholds partners are told to implement and that Punchh itself enforces, and the outbound webhook retry ladder. Two things are published but unquantified — the existence of separate direct-access and partner (indirect-access) endpoint tiers with different thresholds, where the partner tier is explicitly "a much higher threshold" gated behind IP allowlisting. Per-key request quotas are shared during partner certification and are not public.

Punchh Rate Limits is the machine-readable rate-limit profile for Punchh on the APIs.io network, in the API Commons Rate Limits shape.

It captures 4 rate-limit definitions.

Limit state is signalled in the published, x_ratelimit, ratelimit, and retry_after response headers, and an exhausted limit returns HTTP 429.

The profile also includes 3 backoff/retry policies defined and response codes documented for throttled and timeout.

Tagged areas include Rate Limiting, Loyalty, and Restaurant.

4 Limits Exhausted: HTTP 429 publishedx_ratelimitratelimitretry_after
Transcribed from the provider's documentation on 2026-08-13 — developers.partech.com/docs/dev-portal-developer-resource....
View Source
Rate LimitingLoyaltyRestaurant

Limits

Failed authentication lockout per-IP
· per 10 minutes
10 failed authentications/10 minutes
Stated as the control Punchh applies and expects partners to mirror on their own front door. Applies to web and mobile endpoints alike — "our mobile endpoints are subject to the same rate limits as web endpoints."
Password reset per-IP
· per 1 hour
10 resets/1 hour
Direct-access API endpoints per-client-IP
not published
For partners whose mobile app talks straight to Punchh. Security controls and rate limits "already assume direct client connections". Threshold not stated.
Partner (indirect-access) API endpoints per-partner, keyed on the x_true_client_ip header
not published — explicitly higher than the direct-access tier
For partners who proxy guest traffic. Punchh onboards these onto dedicated partner endpoints with "a much higher threshold on rate limiting", protected by an IP allowlist so attackers cannot benefit from the same threshold. Critically, rate limiting on this tier is performed against the x_true_client_ip header the partner supplies — NOT the connecting IP — so a partner that omits or forges that header breaks Punchh's ability to rate limit per guest. Requests without it are filtered and ignored.

Policies

Raise limits via the partner program
Higher throughput is negotiated through PAR partner certification and IP allowlisting, not self-service. Changing a threshold requires contacting a Punchh representative with a justification, assessed case by case.
Environment separation
Sandbox and production base URIs are issued separately by a Punchh representative. Load and security testing should target the sandbox.
Idempotency over retry
Check-ins and redemptions accept the partner's own external_uid so a retry after a throttle does not double-count loyalty activity.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/punchh-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.