RubyGems · Rate Limits

Rubygems Rate Limits

RubyGems.org enforces rate limits at two layers. A load balancer tier caps raw request rate per source IP across the API and website. An application tier (rack-attack) layers additional limits on auth, MFA, gem ownership, and gem publishing endpoints. Limits apply per IP/account; there is no paid tier to raise them. Extreme abuse can result in IP blackholing, with appeal via support@rubygems.org.

Rubygems Rate Limits is the machine-readable rate-limit profile for RubyGems on the APIs.io network, in the API Commons Rate Limits shape.

It captures 6 rate-limit definitions, measuring requests_per_second, requests_per_window, and requests_per_hour.

Limit state is signalled in the retryAfter response header, and an exhausted limit returns HTTP 429.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled.

Tagged areas include Ruby, Package Manager, Open Source, Developer Tools, and Rate Limiting.

6 Limits Exhausted: HTTP 429 retryAfter
Method: generated, dated 2026-05-05.
Written by API Evangelist on 2026-05-05 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
RubyPackage ManagerOpen SourceDeveloper ToolsRate Limiting

Limits

Load balancer (API and website) IP
requests_per_second · second
10
Applies broadly to rubygems.org API and website traffic from a single source IP.
Load balancer (Dependency API / Compact Index) IP
requests_per_second · second
15
Slightly higher cap reflecting bundler resolver behavior.
Auth and account endpoints IP
requests_per_window · minute
100
100 requests per 10 minutes across sign-in, sign-up, password reset, profile, and email confirmation.
Sensitive operations (exponential backoff, short window) account
requests_per_window · minute
300
300 requests per 5 minutes against MFA, ownership changes, API key retrieval, and gem yanking.
Sensitive operations (exponential backoff, long window) account
requests_per_window · day
600
600 requests per 25 hours against MFA, ownership changes, API key retrieval, and gem yanking.
Gem publishing (POST /api/v1/gems) account
requests_per_hour · hour
400
400 successful pushes per hour. Failed pushes additionally counted at 300 / 5 min and 600 / 25 hours.

Policies

Retry-After signaling
Throttled responses include a Retry-After header indicating when to retry. Clients should wait at least that long before retrying.
Exponential backoff on sensitive endpoints
rack-attack escalates penalties on MFA, ownership, key, and yank endpoints; clients should apply exponential backoff with jitter on 429 responses.
No paid raise path
There is no commercial tier to raise limits. High-volume consumers are expected to mirror the index, use the compact index efficiently, or contact support@rubygems.org.
IP blackhole for abuse
Persistent abusive sources may be blackholed at the network edge. Recourse is via support@rubygems.org.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/rubygems-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.