What happened
The organization sent more than 10,000 requests in one minute. The limit is the same on every plan, and it is one bucket shared by every key and project in the organization, so another key does not add capacity. Keyless x402 requests are limited separately, per IP address, at 300 attempts a minute. A 429 that carries anX-Concurrency-Limit header is a different limit: too many requests in flight at the same time on one credential (an API key or an OAuth grant), rather than too many over the minute. The header gives the maximum number of requests one credential may have running at once. Cap your client’s concurrency at or below that number and retry. Enterprise and Marketplace plans are not subject to the concurrency limit.
Response headers
Responses for API-key-authenticated requests include rate limit headers so clients can track their usage:How to fix
WaitRetry-After seconds, then continue; X-RateLimit-Remaining tells you how close to the limit you are before a 429 lands. Spread a burst over the minute or run fewer workers rather than retrying at once, and if Retry-After is longer than a job’s deadline, reschedule the job instead of polling. The wrapper in Handle errors and retries does all of this.