Rate limits

Each API has its own limits; there is no global quota. Limits use fixed one-minute windows. Going over a limit returns HTTP 429.

Frontline

Frontline limits apply per identity and are shared across all Frontline methods. The limit depends on how your token was obtained (its amr claim):

Credential	Token amr	Default limit
Public key	pubkey	200 requests/minute
Passkey	passkey	200 requests/minute
Client secret	secret	60 requests/minute
Password and TOTP	pwd, otp	60 requests/minute

These defaults are configurable. Opening a stream counts as one request; messages on an open stream don’t count. Each identity can also hold up to 1,000 concurrent streams across all streaming methods. Past that, new streams fail with RESOURCE_EXHAUSTED. Treat it as a safety ceiling, not a target.

For the higher limit, use a public-key service account.

GTFS-RT

10 requests/minute per identity, per feed. Trip updates and vehicle positions have separate budgets. The limit is the same for every credential type, and conditional requests that return 304 count too.

Identity

Identity limits apply per client IP address:

Requests	Limit
/connect/token, passkey, and account-recovery requests	20/minute, shared
/connect/challenge	10/minute
/connect/revocation	20/minute

Staying within limits

• Frontline and GTFS-RT limits follow the identity, not the token. Getting a new token doesn’t reset them.
• All workers using the same identity share one budget.
• Rejected and failed requests can still count.
• Windows are fixed, so spread requests out instead of bursting at the start of each minute.
• Retry-After isn’t guaranteed. See retry and backoff.