Rate Limits

DZap rate-limits requests to keep the API responsive. Limits are applied per-IP without an API key, and per-key with one. See Authentication for how to send a key.

Limits

Surface	Without a key	With an API key
Trade API (`api.dzap.io`)	5 req/60s/IP, all endpoints	per-key tier
Fuse API (`zap.dzap.io`)	60 req/min/IP, all endpoints	per-key tier

Each limit is one budget per IP shared by every endpoint of that API, not one per endpoint. A quote, a build and a status check each use one of the five Trade API requests.

The unauthenticated Trade API limit is low enough to hit during normal development: five requests a minute in total, so a quote, a build and a few status checks can use it up. Use an API key while iterating.

Response headers

Rate-limited responses carry:

x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 2026-07-27T15:41:43.121Z
x-ratelimit-window: 60

x-ratelimit-reset is an ISO-8601 timestamp, not a Unix epoch. x-ratelimit-window is the window length in seconds.

When you hit a limit

You’ll get 429 Too Many Requests:

{
  "error": "Rate limit exceeded",
  "message": "Too many requests for route /buildTx. Try again later.",
  "retryAfter": 60,
  "resetTime": "2026-07-27T15:40:52.786Z",
  "limit": 5,
  "window": 60
}

retryAfter is in seconds. Retry with exponential backoff.

The 429 body is an error object, not the shape the endpoint normally returns. Code that parses a success shape without checking the status first reads it as empty — an empty token list looks like “this chain is unsupported” rather than “you are rate limited”. Check the status before parsing.

const res = await fetch(url, { headers: { 'x-api-key': KEY } });

if (res.status === 429) {
  const { retryAfter } = await res.json();
  throw new Error(`Rate limited — retry in ${retryAfter}s`);
}
if (!res.ok) throw new Error(`Request failed: ${res.status}`);

return res.json();

Best practices

Batch where possible — /v1/quotes accepts an array in data. One request, many quotes.
Cache quotes briefly — quotes are short-lived; cache server-side if you re-render the same pair.
Use an API key in production — per-key limits are higher and more predictable than per-IP.

Need more headroom?

Email support@dzap.io with your projected req/sec and use case.

​Limits

​Response headers

​When you hit a limit

​Best practices

​Need more headroom?

Limits

Response headers

When you hit a limit

Best practices

Need more headroom?