Stack Overflow API quota limits for authenticated versus anonymous requests

Answer to the Question

For the current Stack Exchange API (v2.3), the daily request ceiling is:

• Unauthenticated (no key or OAuth token): 300 requests per day per IP address.
• Authenticated (OAuth token or key provided): 10,000 requests per day per key.

In addition, the API enforces a per‑second burst limit of 10 requests per second for anonymous traffic and 20 requests per second for authenticated traffic. These burst limits are reflected in the X-RateLimit-Remaining header on each response.

IP‑Based vs Token‑Based Limits

The IP‑based 300‑request cap applies only to anonymous traffic. Once a valid key or OAuth token is presented, the request is governed solely by the key’s quota; the originating IP no longer limits the daily count. However, the per‑second burst limit still applies to all traffic regardless of authentication.

How to Verify the Limits

You can confirm the limits by inspecting the response headers of any successful request. Here’s a quick curl example for each case:

# Anonymous request – no key or token
curl -i "https://api.stackexchange.com/2.3/questions?order=desc&sort=activity&site=stackoverflow"

# Authenticated request – include your key or OAuth token
curl -i "https://api.stackexchange.com/2.3/questions?order=desc&sort=activity&site=stackoverflow" \
     -H "Authorization: Bearer <YOUR_OAUTH_TOKEN>"

Look for the following headers in the response:

• X-RateLimit-Limit – the maximum number of requests allowed in the current window.
• X-RateLimit-Remaining – how many requests you have left.
• X-RateLimit-Reset – the UTC timestamp when the counter will reset (midnight UTC).

Example output for an anonymous call:

HTTP/1.1 200 OK
X-RateLimit-Limit: 300
X-RateLimit-Remaining: 298
X-RateLimit-Reset: 1707993600

And for an authenticated call:

HTTP/1.1 200 OK
X-RateLimit-Limit: 10000
X-RateLimit-Remaining: 9998
X-RateLimit-Reset: 1707993600

Practical Considerations

• If you hit the 300‑request limit while unauthenticated, you’ll receive a 429 Too Many Requests response until the reset time.
• Authenticated apps should monitor X-RateLimit-Remaining to avoid exceeding the 10,000‑request ceiling.
• Even with a key, the per‑second burst ceiling still applies; sending bursts above 20 req/s can trigger temporary throttling.
• For applications behind a NAT or proxy, multiple users sharing the same external IP will collectively share the 300‑request anonymous limit.

Uncertainty & Future Changes

These figures come from the publicly documented behavior of the API’s latest stable release. The Stack Exchange team may adjust limits in future updates, so keep an eye on the official FAQ and changelog. If you notice discrepancies, double‑check the headers on a fresh request or contact the API support team for clarification.