Limits and Security
Rate limits per surface, what a leaked key can do, error codes, and the planned per key policy for market makers: IP allowlists, tiers, rate limit headers.
Limits today
Per client IP unless stated. Limited responses are 429; WebSocket handshakes answer 429 or 503.
| Surface | Limit |
|---|---|
| TRUE market data REST | 600 requests a minute |
TRUE account reads (/api/perps-dex/* with a session) | 240 requests a minute |
| SSE stream | 32 concurrent streams, 240 connects a minute; 5,000 per server replica |
| WebSocket | 6 sockets and 60 handshakes a minute per account (32 and 240 per IP); 40 topics per socket; 30 client frames burst, 5 a second sustained |
| MCP, per key | market data 120 a minute, chat 10 a minute, points 30 a minute, key validation 60 a minute |
Venue REST (dex-prod) | no published per IP limit today; treat 600 reads a minute and 120 order calls a minute as the ceiling you design for |
TRUE’s own services are exempt from every edge rule, so a limit you hit is yours alone.
What a leaked key can do
A sequencer API key can place, modify and cancel orders on its account until revoked. It cannot withdraw (owner signature only) and cannot change the owner. An MCP key with trade:execute can propose trades, each still approved by the user in the app; with read it can see balances and positions. Revoke first, rotate second, then look at what was placed.
Store keys in a secret manager, never in a repository, a prompt or a shared document. Use one key per bot so a revoke stops one thing.
Errors
| Symptom | Cause |
|---|---|
401 invalid token format on the venue | missing apikey_ prefix |
ApiKeyIdentityConflict | pubkey headers on an API key read |
Invalid signature | wrong borsh order, digest bytes signed instead of the hex text, size or price string differs between signed payload and body, timestamp mismatch |
WebSocket upgrade 403 | account not in the socket rollout, or bad token; use SSE |
WebSocket upgrade 429 | more than 6 sockets or 60 handshakes a minute for one account, or more than 32 sockets or 240 handshakes a minute from one IP |
429 on REST or SSE | over the per minute limit; back off for the rest of the minute |
| book looks wrong | a delta applied after a sequence gap; resubscribe orderbook:SYM |
Planned: per key policy for market makers
The next release attaches a policy to every key:
| retail | pro | market maker | |
|---|---|---|---|
| requests a second (burst) | 5 (20) | 20 (100) | 100 (500) |
| sockets | 2 | 4 | 10 |
| topics per socket | 40 | 100 | 400 |
| streams | 4 | 8 | 16 |
| IP allowlist | optional | optional | required |
With it: an IP allowlist per key (a request from outside the list is refused with 403 ip_not_allowed, never rate limited), API key auth on the WebSocket upgrade, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset on every TRUE response and Retry-After on 429, and a gateway trade route on TRUE that forwards your signed order untouched to the venue after checking the policy. Tiers are granted, not self assigned: request one from the MCP & API page with your IPs and expected volume.
Market makers: write to the team through the app (Kira) with your IPs and the markets you intend to quote, and we set the tier before you connect.