By Alpit Patel and the aibrevo team · October 22, 2026 · 5 min read
What Is the Keap API Rate Limit?
Quick answer
Keap limits OAuth2 tokens to 1,500 requests per minute and 150,000 per day, and personal access tokens or service account keys to 10 per second, 240 per minute and 30,000 per day. A per-application cap of 10,000 per minute and 250,000 per day took effect June 8, 2026, and a spike arrest policy allows 25 calls per second.
Key takeaways
- OAuth2 bearer tokens get 1,500 queries per minute and 150,000 per day per key and secret pair, across all Keap apps it accesses (Keap developer docs, checked Oct 22, 2026).
- Personal access tokens and service account keys get 10 per second, 240 per minute and 30,000 per day, and work with one authorized app only.
- A per-application-instance cap of 10,000 requests per minute and 250,000 per day applies regardless of token type, effective June 8, 2026, and is enforced at the tenant level.
- Daily windows reset at 12:00 AM UTC, and a spike arrest policy allows 25 calls per second by default with no metrics returned.
- Keap's guidance for 429 errors is exponential backoff, respecting a retry-after header if present, and watching the quota and throttle headers on each response.
Keap has three overlapping API limits. OAuth2 tokens get 1,500 requests per minute and 150,000 per day. Personal access tokens and service account keys get 10 per second, 240 per minute and 30,000 per day. Since June 8, 2026, each application instance is also capped at 10,000 per minute and 250,000 per day. These figures come from Keap’s throttles and quotas documentation, checked on October 22, 2026.
What are the Keap API rate limits by token type?
| Limit layer | Per second | Per minute | Per day | Resets |
|---|---|---|---|---|
| OAuth2 bearer token (per key and secret pair, across all Keap apps it accesses) | Not stated | 1,500 | 150,000 | 12:00 AM UTC |
| Personal access token or service account key (one authorized app per key) | 10 | 240 | 30,000 | 12:00 AM UTC |
| Per application instance, any token type (effective June 8, 2026, enforced at tenant level) | Not stated | 10,000 | 250,000 | 12:00 AM UTC |
| Spike arrest policy | 25 by default | n/a | n/a | n/a, no metrics returned |
Source: Keap developer documentation, “Throttles and Quotas” and “API Token Quota and Usage Measurements”, checked Oct 22, 2026. Keap says limits may change.
What does the new per-application cap change?
It puts one ceiling over everything connected to your Keap account. The cap is 10,000 requests per minute and 250,000 per day per application instance, applies regardless of token type and is enforced at the tenant level. Several integrations using separate OAuth2 keys can each be under 150,000 per day and still hit the 250,000 total. The tenant headers (x-keap-tenant-throttle-limit, 10000 per minute in Keap’s example) show how much of the shared cap is left. Keap’s page does not describe what happens to individual integrations once the shared cap is hit, other than that 429 responses should be handled.
How long does it take to use a Keap quota?
The arithmetic is yours to run. It shows which limit binds first.
| Token | Minute limit | Daily limit | Minutes of full-speed calling to use the day | Average calls per second at the minute limit |
|---|---|---|---|---|
| Personal access token or service key | 240 | 30,000 | 125 | 4 |
| OAuth2 key and secret pair | 1,500 | 150,000 | 100 | 25 |
| Per application instance | 10,000 | 250,000 | 25 | about 167 |
Calculated by us from Keap’s documented figures, checked Oct 22, 2026: daily limit divided by minute limit, and minute limit divided by 60.
Two takeaways. A personal access token allows 10 calls in any second, but only 240 in a minute, so a steady rate above 4 per second still hits the minute cap. And the 25 per second spike arrest default is the same as the OAuth2 minute limit expressed per second (1,500 divided by 60), so bursts above 25 per second are the more likely trigger on OAuth2.
How do you read your Keap quota in the API response?
Keap sends informational headers on every call. Keap’s throttling FAQ confirms the first two token tiers and the daily reset.
| Header family | Example fields |
|---|---|
| Quota | x-keap-product-quota-limit, -time-unit (day), -interval (1), -available, -used, -expiry-time |
| Throttle | x-keap-product-throttle-limit (example 1500), -time-unit (minute), -interval (1), -available, -used |
| Tenant | x-keap-tenant-id, x-keap-tenant-throttle-limit (10000), -time-unit (minute), -available, -used |
Source: Keap developer documentation, checked Oct 22, 2026.
Keap recommends monitoring x-keap-tenant-throttle-available and x-keap-product-quota-available on every response, so your code slows before it gets refused.
Why am I getting 429 errors from the Keap API?
| Symptom | Likely cause | Fix |
|---|---|---|
| HTTP 429 after a burst of calls | Per-second spike arrest (default 25) or the per-minute throttle | Queue and pace requests. Back off exponentially. Honor retry-after if present |
| 429 late in the day, fine after midnight UTC | Daily quota used up (30,000 PAT, 150,000 OAuth2, 250,000 per application) | Spread work across the day. Daily windows reset at 12:00 AM UTC |
| 429 although your integration is quiet | Another integration is spending the shared tenant cap | Check the tenant headers. Move bulk jobs to off-peak hours |
| Personal access token fails at 5 to 10 calls a second | Minute cap of 240 binds (4 per second average) | Throttle to 4 per second, or use OAuth2 |
| Cannot see why spike arrest fired | Keap returns no metrics for spike arrest | Rate limit on your side below 25 per second |
Source: Keap developer documentation, checked Oct 22, 2026. The causes in the last three rows apply the documented limits and are our reading, not Keap-stated diagnoses.
Keap’s page lists no error codes beyond HTTP 429. For how this compares across platforms, see our CRM API rate limits comparison and the monday.com daily API call limits.
Can you ask Keap to raise the limit?
The pages we read do not describe a process for raising these limits, and they note that limits may change over time. If a one-time bulk job is the reason you are near the limits, a file export is usually cheaper than API calls, as covered in how to export contacts from Keap.
When to get help
Limits become a problem when a sync, a bulk load or several integrations share one tenant cap. Get help when you are building two-way syncs, a migration that reads the whole database through the API, or a replacement for Keap altogether. aibrevo implements Salesforce, HubSpot, Dynamics 365, Zoho CRM, Pipedrive, monday.com, Airtable and GoHighLevel, and Keap work is quoted per project. Book a short call or send a message. The CRM integrations guide and Salesforce service page are good places to begin.
Sources
- Keap developer documentation, API Token Quota and Usage Measurements, checked Oct 22, 2026.
- Keap developer documentation, How does throttling work?, checked Oct 22, 2026.
- Not verified and left out: community-forum figures for older legacy keys, and any process for raising limits.