A 429 that follows one API key’s traffic is not proof that the vendor is down or throttling you. It means some limiter, at some scope, decided a caller had sent too many requests. When one key is shared across services, that limiter can turn one busy caller’s burst into a minute of failures for everyone using the key. The cause may be the gateway, the upstream provider, or your own retry logic, and each needs a different fix.
This article shows how to tell those causes apart. It does not identify a specific gateway or vendor. The mechanisms below come from the HTTP standards and from documented gateway behaviour. Treat the 60-second blackout as a hypothesis to confirm against your own logs and configuration.
![[Cheat-Book] API-Gateways - nginx, Zuul & AWS in 15 Minuten: Microservices (Spring Boot & Co.) durch ein API-Gateway verwaltet (German Edition)](https://m.media-amazon.com/images/I/41Onn5LmvhL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
What a 429 does and does not tell you
RFC 6585 (IETF, April 2012) defines 429 as “too many requests” within a period. It deliberately leaves open how the server identifies the user and counts requests. The count might be per resource, across one server, or across a set of servers, and it may be tied to credentials or a cookie. So a 429 tells you that a limit was hit. It does not tell you which limit, or whose.
That is how blame ends up in the wrong place. If failures began when one key started sending heavy traffic, “the vendor is flaky” and “our key is being throttled” look identical from the client. Only the scope of the limiter separates them.
#1 Best Overall
What Retry-After means, and what it does not
Under RFC 6585, a 429 response may include a Retry-After header. RFC 9110 (June 2022), section 10.2.3, says servers send it “to indicate how long the user agent ought to wait before making a follow-up request.” The value is either an HTTP date or a number of seconds.
Two consequences follow:
- The header is optional. A 429 without it gives you no server-specified wait, so any pause your client applies is your own policy.
- No standard sets a 60-second cooldown. If you see exactly 60 seconds of failure, it came from a specific window, header value, timer or breaker setting. Find which one.
Where a 60-second blackout can come from
Several different mechanisms can produce the same one-minute symptom. The table lists the candidates and the evidence that distinguishes them.
Rank #2
- Flexible & Reliable Connectivity: Connect the Hub to your router via Ethernet cable or WiFi for a stable connection. This link is required for initial provisioning and remote App access. However, once configured, the Hub ensures that your pre-configured local automations and Local API integrations continue to function even if your external internet connection goes down.
- App-Based Management: The YoLink App provides an intuitive interface for setup and monitoring. Please Note: An active internet connection is required to provision the hub, create or modify local automation rules, and sync device settings.
- Local Execution & Low Latency: Once your local automation rules are synced, the Hub executes them locally. This means your schedules, timers, and device automations don't have to wait for a cloud signal to travel back and forth, resulting in instant response times and higher reliability during internet outages.
- Open Local API for Power Users: The Hub supports a Local API, allowing you to integrate YoLink devices directly with third-party local control centers like Home Assistant. This feature enables you to bypass the cloud for daily control and keep your smart home data and automation logic within your own local network.
- Up to 2034 Feet Range: Powered by LoRa technology, the Hub maintains a robust connection with devices up to 2034 feet away. Please Note: For Local API or App access to function during a blackout, your home’s network infrastructure (router/switch) must also remain powered and active.
| Candidate cause | What it looks like | How to confirm |
|---|---|---|
| Per-key limiter at the gateway or provider | Every caller using that key gets 429s together; other keys keep working | Send a request with a different key at the same moment; compare |
| Broader account, organization or regional limit | Other keys and routes in the same account also fail | Check whether unrelated keys fail at the same timestamps |
| Window-based counter (fixed or sliding) | Failures clear when the window rolls over, often near a minute boundary | Read the policy configuration; look for reset headers |
| Server-supplied Retry-After | Clients pause for the header’s number of seconds | Inspect raw responses for the header value |
| Local retry timer or circuit breaker | The gateway or client stops sending for a fixed period after errors, even if the upstream has recovered | Check whether requests were sent at all during the blackout, or suppressed locally |
The last row matters most for a gateway. A single 429 can trip a gateway-wide breaker or cooldown that is keyed to the upstream rather than to the offending caller. The upstream then looks “down” for a full minute when only one key’s quota was exhausted.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow a shared key couples unrelated callers
When several services send the same credential, a limiter keyed on that credential sees them as one client. A batch job and a customer-facing path then draw from the same budget. Whichever sends the burst spends it, and the other gets the 429.
Scope varies by implementation. Constellation Gate’s “Limits and retention” documentation, for example, describes an organization-wide requests-per-minute cap shared across API keys, plus an optional per-key limit, both using 60-second sliding windows. That is one vendor’s design. It shows that scope and window are implementation choices, and it does not establish that your gateway works this way.
Limits can be layered
Gateways often enforce several limits at once. AWS’s REST API Gateway documentation lists per-client and per-method limits, stage-level method limits, account-level limits per region, and AWS regional limits, applied in a defined order. AWS describes these throttle settings as best-effort targets, not guaranteed ceilings. Its HTTP API documentation similarly describes account-level regional and route-level throttling. These are AWS behaviours, offered here as examples of layering and not as a diagnosis of any other gateway.
Layering means the limit you hit may not be the one you configured. A per-key allowance can be comfortable while a route-level or account-level ceiling is the one tripping.
Vendor policies can also differ sharply in how long a block lasts. Cloudflare’s “Rate limits” page (last updated August 25, 2026) documents 1,200 Client API requests per five-minute period per user, with calls blocked for the next five minutes once that global limit is exceeded. That is Cloudflare’s own policy. It is unrelated to a 60-second window, which is the point: do not assume another provider’s numbers.
Best Value
How to diagnose it
- Capture a full failing response. Record the status, body, Retry-After and any rate-limit or reset headers, the request ID, the route, and a timestamp with timezone.
- Decide who answered. Check whether the 429 came from your gateway or was passed through from the upstream. Body format, server headers and gateway logs usually settle this.
- Run a control request. While the blackout is active, send a request with a different key to the same route, and the same key to a different route. Compare the results.
- Check scope. If other keys also fail, suspect an account, organization or regional limit. If only the one key fails, suspect a per-key limiter or a breaker keyed to it.
- Measure the duration. Compare the blackout’s length with the Retry-After value, with any window length in the policy, and with your own retry and circuit-breaker settings. A match points to the source.
- Check whether requests were actually sent. If logs show no outbound calls during the minute, the blackout was suppressed locally and the vendor never refused anything.
- Attribute traffic to callers. Break per-key request counts down by service or process to find who spent the shared budget.
Fixes once the scope is known
- Give each caller its own key where the limiter is per key, so a batch job cannot starve interactive traffic. This does not help if the real limit is account-wide.
- Scope breakers narrowly. Trip them per key or per route, not per upstream, so one 429 does not blank everyone.
- Honour Retry-After when present, and use exponential backoff with jitter when it is absent, so retries from many callers do not land together.
- Shape traffic before the limit. Client-side throttling or a queue for bulk work keeps bursts under the budget.
- Log limiter headers and who produced the 429. Record the scope and source, so the next incident is diagnosed in minutes instead of months.
- Raise limits with evidence. If the vendor or account owner must change a quota, send them timestamps, request IDs and raw responses.
What can and cannot be concluded
Nothing public identifies the gateway, the vendor or the limiter in this particular incident, and no published figure shows how common shared-key blackouts are. What the standards and gateway documentation do support is narrower: a 429 does not name its scope, Retry-After is optional and carries no fixed duration, and limits at key, route, account and region levels can stack. A minute-long outage that tracks one key is a strong hint to check the key-level limiter and any gateway cooldown before blaming the provider. Only the raw responses and configuration can confirm it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
