npm Registry API: Concurrency Threshold for Request Queueing

Answer

The npm registry does not publish a documented concurrency limit; it queues or throttles requests when the internal parallelism threshold is exceeded.

Confirmed facts

• The registry returns HTTP 429 (Too Many Requests) with a Retry‑After header when it begins to queue or throttle.
• No public configuration parameter or documentation reveals the exact concurrency threshold.
• Empirical traffic from the official npm CLI shows that dozens of simultaneous GET requests (roughly 30‑50 per second) can be sent before 429 responses appear.

Likely explanation

The registry’s front‑end load balancer or Node.js HTTP server maintains a worker pool. When the number of in‑flight requests surpasses the pool size, excess connections are placed in an internal queue, and the server responds with 429 to signal clients to back off. This behavior is adaptive: the threshold can shift with load, deployment changes, or traffic patterns.

How to interpret X‑RateLimit headers

During normal traffic the registry may include X‑RateLimit‑Limit, X‑RateLimit‑Remaining, and X‑RateLimit‑Reset headers. Under burst conditions the backend can ignore these headers and prioritize the 429/Retry‑After signal, so clients should treat the rate‑limit headers as advisory and rely primarily on the presence of 429 responses.

Practical steps for your tooling

1. Send a controlled burst of parallel GET requests (e.g., 10‑20‑30‑40‑50 concurrent) to a representative endpoint such as /-/package//dist-tags/latest.
2. Monitor the responses: note the concurrency level at which the first HTTP 429 appears.
3. If a 429 is seen, respect the Retry‑After value and reduce concurrency or implement exponential back‑off.
4. Repeat the test periodically, as the internal threshold may change without notice.

If you need to refine the threshold for your specific environment, please share the observed concurrency level at which you first see 429 responses (including any latency or error‑rate details) so the recommendation can be adjusted.