Skip to main content

​
Base URL

Interactive API explorer (Scalar): https://api.limitless.exchange/api-v1
Building on the API? Join the Limitless Builders Chat on Telegram for API/SDK updates, help, and to connect with other builders.

​
Authentication

Most endpoints require authentication via scoped API tokens with HMAC-SHA256 request signing:
Public endpoints like market browsing and orderbook data do not require authentication. All authenticated requests use scoped API tokens with HMAC signing (legacy static API-key headers are deprecated and no longer issued).
See the Authentication guide for HMAC signing details, or the Programmatic API guide for the full partner integration workflow.

​
Endpoint groups

Authentication

Derive and manage scoped API tokens for authentication.

API Tokens

Scoped API token management for partner integrations — derive, list, and revoke HMAC-authenticated tokens.

Markets

Browse active markets, search, get details and feed events.

Trading

Create and cancel orders, batch order status, orderbook, historical prices, and user orders.

System

Check public maintenance status and temporary trading restrictions.

Partner Accounts

Create and manage sub-accounts for partner integrations.

Portfolio

Positions, trades, PnL chart, history, points, and allowance.

Public Portfolio

Public user positions, traded volume, and PnL data.

​
Key concepts

​
WebSocket API

For real-time orderbook and position updates, see the WebSocket Events reference. URL: wss://ws.limitless.exchange | Namespace: /markets

​
Rate limits

The API enforces rate limits. When you exceed a limit, requests return HTTP 429 Too Many Requests. Handle 429 responses with:
  • Respect Retry-After — when present on a 429 response, wait for that many seconds before retrying.
  • Exponential backoff — if no Retry-After header is returned, back off starting at 1 second and double on each retry.
  • Throttle at the source — for high-frequency workloads (e.g. market making), queue outgoing orders instead of firing them concurrently. The TypeScript SDK ships an OrderQueue; Python, Go, and Rust SDKs expose configurable retry-on-429 helpers in their error-handling guides.
  • Never retry 400 or 401 — those indicate a bad request or invalid credentials and will not succeed on retry.
Partner allowance endpoints return a retryAfterSeconds field on 429 — see Retry Partner Account Allowances. For higher published limits or a dedicated quota, contact help@limitless.network.