· 9 min read · API
Rate limits and keys: Operating a contact lookup API in production
Rate limits and keys: operating a contact lookup API in production – key hygiene, 429 backoff, and found-only credits when enrichment is live.
Shipping a contact lookup into production is less about a demo cURL and more about keys, quotas, and failure modes. Products that bolt enrichment on day one often leak keys in browser bundles, retry forever on 429, or treat every HTTP call as a billable event. Operating Invenitor well means the opposite: A people search and lookup API, not a sales cloud and production hygiene.
Hub: LinkedIn or GitHub Profile URL → Contact Lookup API. GitHub spoke: GitHub Profile URL Contact Lookup. Layer: Contact Lookup API vs CRM vs Sequencer.
Keys: store, rotate, scope
| Practice | Do | Don't |
|---|---|---|
| Storage | Server env / secret manager | Frontend bundle, public repo |
| Rotation | Rotate on staff exit and quarterly | Share one eternal key in Slack |
| Scope | One key per environment | Same key for staging + prod |
Rate limits: design for 429
Rate limits protect shared capacity. When you hit a limit, back off with jitter – do not spin a tight retry loop that looks like abuse. Queue shortlists; process in batches.
Credits are not the same as HTTP calls
Demand that contract in writing – What Are API Credits in Enrichment Products?, What Is Pay-Per-Lookup Pricing?. Coverage: coverage varies; we do not publish hit-rate percentages.
Observability that PMs care about
- Alert on key 401 spikes (rotation / leak).
- Alert on sustained 429 (batch size too aggressive).
- Keep primary contact fields honest.
MCP and agents share the same pool
Agents calling lookup via MCP must use the same key hygiene and credit pool as REST – /mcp.md, Claude / Cursor Agents, Agent-Readable Docs,
Commercial operations
INR packs, Razorpay/UPI, 30-day windows – INR Credit Packs, 25 to 1,000 Credits, /pricing. Trust: Trust Checklist Before You Buy Any Contact API.
What should you do next?
Put the key in a secret manager. Confirm ledger vs found-only billing. Size a pack on /pricing. Wire agents only after /mcp.md is in the runbook.
Incident playbook (short)
Staging checklist
Separate key. Layer: Contact Lookup API vs CRM vs Sequencer. Commercial: INR Credit Packs, Razorpay, UPI, Cards, Wallets.
Questions
Where should API keys live?
Server-side secret storage – not browser bundles, mobile apps, or public repos.
What should we do on HTTP 429?
Back off with jitter, queue the shortlist, and reduce batch concurrency. Do not tight-loop retries.
Do rate-limit errors spend credits?
They should not.
Can staging and production share one key?
Prefer separate keys per environment so a staging leak does not burn production capacity.
How do agents affect rate limits?
MCP tools share the same pool and limits as REST – configure concurrency in the agent, not by scraping.
Where is the integration guide?
/docs for REST, /mcp.md for agents, /pricing for packs.
How does this relate to CRM architecture?
See Adding Contact Lookup to a CRM and REST Enrichment Inside a Product for auth and sync patterns.
