> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xo.market/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate Limits

> Per-tier request and connection limits for REST and WebSocket clients.

XO enforces per-connection and per-action limits. Order placement and cancellation share the same budget within each order mode; the listed limits do not stack.

| Tier / Action                                       |                         Limit |
| --------------------------------------------------- | ----------------------------: |
| Public REST requests                                |         5 requests per second |
| Public WebSocket connections                        |      3 concurrent connections |
| Authenticated single order placement + cancellation | 250 requests per second total |
| Authenticated batch order placement + cancellation  |  25 requests per second total |
| Authenticated batch cancel all                      |         5 requests per second |
| Authenticated WebSocket connections                 |     25 concurrent connections |

## WebSocket connection limits

In addition to the per-tier connection caps above, each WebSocket connection has the following ceilings:

| Limit                | Value            |
| -------------------- | ---------------- |
| Idle timeout         | 60 seconds       |
| Inbound message rate | 100 messages/sec |
| Max message size     | 65 KB            |
| Max subscriptions    | 100 markets      |

Send the literal text frame `PING` to reset the idle timer; the server replies with `PONG`.

## Client guidance

* Throttle on the client. The server will reject excess traffic without backoff hints.
* Keep order placement and cancellation in **separate queues** so a cancellation burst can't starve placements.
* Share a single WebSocket connection across strategies rather than reconnecting on every restart — the connection cap is the binding constraint long before the request cap is.
* Use `GET /time` to keep clocks aligned. L2 HMAC requests fail if `XO_TIMESTAMP` drifts more than ±30 s from server time.