Scryfall · Rate Limits

Scryfall Rate Limits

Scryfall asks that all API consumers keep sustained traffic under 10 requests per second (50-100 ms delay between calls). The /cards/collection endpoint has a tighter 2/second hard cap (500 ms). Large-volume use cases must use the daily bulk-data exports instead of crawling Card endpoints. Every request must include a descriptive User-Agent header and an Accept header; missing or generic headers will cause Scryfall to block or throttle your traffic.

Scryfall Rate Limits is the machine-readable rate-limit profile for Scryfall on the APIs.io network, in the API Commons Rate Limits shape.

It captures 5 rate-limit definitions, measuring requests_per_second, delay_ms_between_requests, identifiers_per_request, and pages_per_minute.

An exhausted limit returns HTTP 429.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled and serviceUnavailable.

Tagged areas include Rate Limiting, Public API, and Free.

5 Limits Exhausted: HTTP 429
Method: generated, dated 2026-05-29.
Written by API Evangelist on 2026-05-29 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
Rate LimitingPublic APIFree

Limits

Global request rate client
requests_per_second · second
10
Soft cap - sustained traffic above 10 RPS will be throttled or blocked. Insert 50-100 ms between requests.
Recommended inter-request delay client
delay_ms_between_requests
50
Scryfall publicly recommends 50-100 ms delay between calls; clients should default to 100 ms.
Cards collection batch endpoint client
requests_per_second · second
2
Hard rate limit on POST /cards/collection (max one call every 500 ms). The endpoint itself accepts up to 75 identifiers per batch.
Cards collection batch size request
identifiers_per_request
75
Maximum identifiers per POST /cards/collection request.
Bulk-data preferred for large ingestion client
pages_per_minute
use bulk-data instead
Scryfall asks that anyone performing a large amount of simple lookups or downloading many images use the bulk-data offerings and process the files locally rather than paginating live endpoints.

Policies

Required headers
Every request must include a descriptive User-Agent header that identifies the application (with contact info preferred) and an Accept header (typically application/json). Generic user agents (curl, python-requests defaults) are routinely blocked.
Backoff
On 429 or 503 responses, retry with exponential backoff and jitter. Do not hammer the endpoint - repeated abuse will trigger longer blocks.
Caching
Card and set data is highly cacheable. Scryfall encourages aggressive local caching to reduce request volume; bulk-data exports are the canonical refresh mechanism.
Image rehosting
Do not embed Scryfall image URIs in production sites - download and rehost images from your own infrastructure to avoid burdening Scryfall's image CDN.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/scryfall-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.