- Layer one: your company's plan limit
- Layer two: partner integrations and Zapier
- Layer three: guards on heavy routes
- Headers and the 429 response
- A retry routine that copes with all three layers
- Planning a sync on a small plan
- How Zendesk's limits compare
- My advice for anyone building on Front
- Frequently asked questions
Front's API rate limit starts at 50 requests per minute by default and varies by plan: 50 on Starter, 100 on Professional and 200 on Enterprise. Limits apply per company, not per token. Partner integrations installed through OAuth get a separate 120 per minute, and going over returns a 429.
Layer one: your company's plan limit
Front counts API calls at three levels, and you'll want to know all three before you build anything that runs at volume. The first is the standard limit for your company.
| Item | Limit | Applies to |
|---|---|---|
| Standard API limit | 50 requests per minute | Starter plan |
| Standard API limit | 100 requests per minute | Professional plan |
| Standard API limit | 200 requests per minute | Enterprise plan |
| Partner integration via OAuth | 120 per minute | Per company |
| Authorization servers | 600 per minute | Servers you connect to your apps |
| Analytics reports and exports | 1 request per 3 seconds | Global guard |
The key point: limits are enforced per company, not per token. Creating a second API token doesn't give you a second allowance. Every script and internal tool your team runs against Front shares the same pool.
If you need more than the default, increases require the Professional plan or higher, through the API rate limit add-on.
Layer two: partner integrations and Zapier
Requests made by a partner integration through OAuth have their own separate 120-per-minute limit, also enforced per company. That's good news: installing a well-known integration won't eat your own scripts' allowance.
There's one exception, and it's a common one. The Zapier integration counts against your own company limit, not the partner pool. A busy set of Zaps on a Starter plan could use up most of your 50 a minute on its own. Calls to servers you configure for authorisation in your apps are limited separately, at 600 per minute.
Layer three: guards on heavy routes
The Front Developer Docs page on rate limits explains the layer that surprises developers most. Some resource-intensive routes carry extra guards on top of the plan limit:
- Analytics reports and exports: 1 request per 3 seconds.
- POST /links: 60 requests per 60 seconds.
- The message-seen route: 10 requests per message per hour.
- Search: 40% of the rate limit.
- Listed per-resource routes: 5 requests per second per route and resource.
A guard can return a 429 even when x-ratelimit-remaining is above 0. So if your code only checks the remaining count, it'll be caught out by a reporting job or a burst of updates to one conversation. Handle a 429 on any call, whatever the headers say.
Headers and the 429 response
Every response includes x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset, and the reset time is never more than one minute away. Go over and you'll get HTTP 429 Too Many Requests with a retry-after header in seconds. Wait that long before trying again.
A retry routine that copes with all three layers
- Before each call, read x-ratelimit-remaining from the last response and slow down as it nears zero.
- On any 429, read retry-after and wait at least that many seconds, even if the headers showed capacity.
- If there's no retry-after, wait until x-ratelimit-reset, which is never more than a minute away.
- Queue analytics and export calls separately, one at a time, at least three seconds apart.
Ask whoever builds your integration to show you where each of these lives in their code.
Planning a sync on a small plan
Here's how it plays out. On Starter's 50 a minute, an export job running every few seconds, a Zapier workflow and an internal script all draw from the same pool. Schedule analytics exports for quiet hours, keep search calls light since they're capped at a share of the limit, and move as many Zaps as you can to a partner integration that has its own allowance. If you're comparing helpdesks partly on this, my roundup of Front alternatives and my guide to help desk software for small businesses are worth reading.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
How Zendesk's limits compare
Zendesk's Support and Help Center API allows 200 requests per minute on Team, 400 on Growth and Professional, 700 on Enterprise and 2500 on Enterprise Plus.
My advice for anyone building on Front
Treat your limit as one shared pool for the whole company, count Zapier against it, and handle 429s everywhere, even when the headers say you've got room. Run exports and analytics on a schedule, not on demand, and only look at the add-on once you've spread the load.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
What's the Front API rate limit?
50 requests per minute by default: Starter 50, Professional 100, Enterprise 200.
Is it per token?
No. It's enforced per company.
Do integrations count against it?
Partner integrations installed via OAuth have a separate 120-per-minute limit. The Zapier integration is the exception and counts against yours.
What happens when I hit it?
HTTP 429 with a retry-after header.
Can I get a higher limit?
Increases beyond the default need the Professional plan or higher and the API rate limit add-on.
