Century Developers
Reference

Rate limits

Century enforces targeted abuse limits rather than a global request budget. This page documents exactly what is enforced today.

Enforced today

ScopeLimitEnforcement
Login OTP1 request per email per cooldown window (returned by getOtpCooldown)Server-side cooldown
Failed loginsProgressive lockout after repeated failureslogin_failed telemetry + lockout
Transaction PINTemporary lock after repeated wrong PINsServer-side PIN guard

Pending

Not yet implemented
  • Global requests-per-minute per account — pending
  • Burst limits — pending
  • X-RateLimit-Limit / X-RateLimit-Remaining / Retry-After headers — pending
Do not depend on rate-limit response headers — they are not emitted yet.

Being a good client

  • Cache catalog reads (data plans, cable packages, billers) — they change at most every 30 minutes.
  • Poll transaction status with backoff, not in a tight loop.
  • Never parallelise purchases for the same wallet; serialise them so balance checks stay meaningful.
  • Treat 429 as a signal to back off across your whole worker pool, not just the failing request.