Besides the general limits already applied to any request (per tenant, per user or per IP, depending on the case), **every request that includes the `X-API-Key` header gets an additional quota of its own for that key**: by default, **120 requests per minute**. Exceeding it returns **429** (section 12) until the following minute frees up quota again. This quota applies as soon as the header is present, even if the key turns out to be invalid or revoked — that way a leaked key used to try random values also can't hammer the server without limit.