Rate limits, IP allowlisting and security practices
Remitian API rate limits, how to restrict access with an IP allowlist, and a checklist for handling credentials and keys safely.
What it is
The Remitian Public API limits request volume, lets you restrict access to known IP addresses, and accepts only encrypted connections over TLS 1.2 or TLS 1.3 (1.3 recommended). This article covers each and the practices that keep your integration secure.
When you need it
- You are seeing
429,401or403responses you do not expect. - You want to lock API access to your servers' IP addresses.
- You are preparing a security review before going live.
How it works
Rate limits. Production allows 1,000 requests per minute per Client Application. Sandbox allows 200 requests per 10 minutes. Above the limit you get 429 Too Many Requests. Retry with exponential backoff: wait 1 second, then 2, then 4, doubling until it succeeds or you reach your maximum attempts. For higher limits, contact support.
IP allowlisting is optional. Editors manage it in the Security section of the Developer Portal, and it applies to every Client Application. Clearing the list turns it off.
| Rule | Detail |
|---|---|
| Entries | Up to 5 |
| Format | Single IPv4 address or IPv4 CIDR range written as the network base (203.0.113.0/24, not 203.0.113.5/24) |
| Range size | No broader than /16 |
| Not accepted | IPv6, wildcards, dash ranges, duplicates, private or non-routable addresses |
| Blocked request | Response |
|---|---|
POST /v1/auth/token from an unlisted IP |
401 Unauthorized (same as invalid credentials) |
| Any other request from an unlisted IP | 403 Forbidden |
Neither response reveals the configured entries.
Security checklist.
- Credentials: never expose the Client Secret in client code or repositories, store it in environment variables or a secrets manager, rotate it periodically, and regenerate it immediately if exposed.
- Webhooks: verify the
payload-signatureheader (HMAC-SHA256) on every delivery and rotate the signature token periodically. - TIN: never put a plaintext TIN in a URL. Encrypt it for TIN filters with the key from the environment you call, and never log or store it in plaintext.
- SFTP: keep SSH and PGP private keys on your systems, verify the host key fingerprint and file signatures, and rotate SSH keys periodically.
Common questions
We just enabled the allowlist but old requests still work. Why?
Enabling a list applies to tokens issued afterwards. Existing tokens keep working until they expire (10 minutes by default). Edits to an existing list take effect within one minute.
We locked ourselves out. What now?
The Developer Portal is not subject to the allowlist, so an Editor can always sign in and fix the list.
Why are our requests refused even though our IP is listed?
Check whether your systems reach the API over IPv6. IPv6 origins never match an entry, so they are refused when a list is configured.
Full documentation