Rate limits protect shared API capacity. Design every integration for bounded concurrency, timeouts, and retry-after handling rather than assuming every request will succeed immediately.

Retry behavior

For a 429, honor the server’s retry guidance when present, use exponential backoff with jitter, and reuse the original idempotency key for a create request. For a 5xx or network timeout, retrieve by ID before creating another payment, session, refund, or subscription.
Do not retry validation, authentication, authorization, or conflict errors unchanged. Keep concurrency limits per merchant and instrument request IDs without logging credentials.