Rate limits

Rate limits are technical ceilings that protect the CARTO Platform and third-party services from abusive or accidental usage patterns (for example, a runaway script hitting an API thousands of times per second).

Unlike quotas, which define how much of CARTO your license includes and can be adjusted commercially, rate limits:

• Are the same for every organization and are not part of your commercial plan or negotiation.

• Are enforced automatically and are always technically hard.

• Do not reduce how much you can use CARTO. They only prevent usage patterns that could affect platform stability or performance. Following standard integration best practices, you should never hit them in normal usage.

If a legitimate use case requires a higher limit, contact [e-mail].

API rate limits

CARTO Cloud is protected by a web application firewall (WAF) that automatically and temporarily blocks any IP address that exceeds the per-minute request limit for an API. Requests over the limit receive a 429 HTTP response, and requests answered by the CDN cache do not count towards the limit.

For the full list of per-API limits, see the CARTO API rate limits reference.

Rate limits protect the API infrastructure and are unrelated to your Usage quota. A request can count towards your Usage quota (based on its API weight) and, if you send too many too quickly, also be rate-limited.

M2M OAuth token minting

Each Machine-to-Machine (M2M) OAuth Client can mint a limited number of OAuth access tokens per month (in the range of 35–300 tokens/month, depending on your plan).

Each M2M access token is valid for 24 hours and is designed to be reused. To stay well within this limit, your backend should request an access token once and reuse it until it expires, rather than requesting a new one for each API call. A correctly implemented integration will never approach this limit — reaching it is almost always a sign that tokens are being minted on every request instead of being cached and reused.

Google basemaps in public maps

On CARTO Cloud, the built-in Google Maps basemaps can be used in your maps without providing your own Google Maps API key. This convenience is intended for regular product use, so their use in public maps is subject to an acceptable-use limit: they are meant for low-traffic public maps.

As a rule of thumb, a public map stays within acceptable use if it receives up to:

Google basemap type	Approximate guideline
2D basemaps	~500 views/day (~15,000/month)
3D (Photorealistic 3D Tiles)	~100 views/day (~3,000/month) — 3D scenes stream many more tiles per view

These are approximate guidelines, not hard technical limits. If a public map consistently exceeds them, it's no longer low-traffic and should use one of the alternatives below.

This applies specifically to the Google basemaps that CARTO provides inside the platform. It is unrelated to CARTO Basemaps, which is a separate offering.

If you expect a public map to receive high traffic (for example, one embedded on a high-visibility website), use one of the following instead:

• CARTO Basemaps

• Your own Google Maps API key

• Your own custom basemap