specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: MikMak
providerId: mikmak
created: '2026-05-04'
modified: '2026-08-12'
generated: '2026-08-12'
method: searched
source: https://docs.mikmak.ai/docs/authentication-1
docs:
  - https://docs.mikmak.ai/docs/authentication-1
  - https://docs.mikmak.ai/docs/tools-1
tags:
  - Analytics
  - Commerce
  - eCommerce
  - Rate Limiting
  - Quotas
  - Throttling
  - MCP
description: >-
  Real published limits for the MikMak Commerce MCP Server, replacing a 2026-05-04 scaffold that
  invented free/professional/enterprise quotas MikMak has never published. MikMak documents
  three independent caps on the MCP layer, enforced in order, and states that the numbers are
  defaults which "may differ per deployment" - your MikMak contact confirms the active quotas.
  The Headless Commerce API and the Insights API are described as rate-limited in prose but
  publish no numbers and no headers of their own.
limit_count: 3
headers:
  limit: X-RateLimit-Limit
  remaining: X-RateLimit-Remaining
  retryAfter: Retry-After
  reset: not-published
  policy: not-published
  on_success: >-
    X-RateLimit-Limit and X-RateLimit-Remaining are returned on successful responses too, so a
    client can self-regulate before being blocked.
responseCodes:
  throttled: 429
  body_code: RATE_LIMITED
  media_type: application/problem+json
limits:
  - name: Global cap
    scope: service
    order: 1
    metric: requests_per_minute
    limit: 1000
    timeFrame: minute
    default: true
    applies:
      - MikMak Commerce MCP Server
    note: Protects the shared service overall.
  - name: Per API key
    scope: api-key
    keyed_by: x-api-key
    order: 2
    metric: requests_per_minute
    limit: 60
    burst: 120
    timeFrame: minute
    default: true
    applies:
      - MikMak Commerce MCP Server
  - name: Per IP
    scope: ip
    order: 3
    metric: requests_per_minute
    limit: 30
    burst: 60
    timeFrame: minute
    default: true
    applies:
      - MikMak Commerce MCP Server
    note: Fallback used only when x-api-key is absent.
undocumented:
  - api: MikMak Headless Commerce API
    note: >-
      The API overview says "the API includes rate-limiting controls that restrict the number of
      requests made within a given timeframe" but publishes no limit, window or header, and the
      OpenAPI declares no 429 response on any of its eight operations.
  - api: MikMak Insights API
    note: No rate limits published; the OpenAPI declares only 200 and 422 on report operations.
  - api: MikMak Auth0 token endpoint
    note: >-
      Auth0 rate-limits /oauth/token per client. MikMak warns that a token-per-request pattern
      "will eventually be throttled" and instructs clients to cache the JWT until
      expires_in - 60 seconds. No number is given.
policies:
  - name: Backoff
    description: Honour Retry-After on 429 and back off; retry a 401 exactly once after refreshing the token, never in a loop.
  - name: Token caching
    description: Cache the access token in memory until 60 seconds before expiry rather than minting one per request.
  - name: Deployment variance
    description: >-
      MikMak states the published numbers are defaults and that exact quotas are
      deployment-specific and confirmed by a MikMak contact.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com