> For the complete documentation index, see [llms.txt](https://hinkal-team.gitbook.io/hinkal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hinkal-team.gitbook.io/hinkal/hinkal-partner/errors-and-limits.md).

# Errors and Limits

Error messages from the API and Hinkal Partner, and the limits behind them.

### API errors

Returned by `api.hinkal.io` on [routes that read the key](/hinkal/hinkal-partner/integrating-your-key.md#routes-that-read-the-key). The body is `{ "success": false, "error": "…" }`.

| Status | Error                                            | What to do                                                                                                                                        |
| ------ | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| `401`  | `Invalid API key`                                | The key is unknown, turned off or revoked, or the value starts with `hk_` but isn't a complete key. Copy it again from the API Keys page.         |
| `403`  | `Origin not allowed for this publishable key`    | Add the exact origin to the key. From servers, use the secret key. From native apps, send calls through a backend proxy that adds the secret key. |
| `503`  | `Partner key service unavailable`                | Temporary. Retry with backoff.                                                                                                                    |
| `400`  | `Invalid ref: '…' is not a whitelisted referral` | Remove `ref` from the body. The key handles attribution.                                                                                          |

Session and signature errors come before key checks, so fix those first. See [Authentication](/hinkal/hinkal-api/description/authentication.md).

***

### Hinkal Partner errors

| Status | Error                                                                                   | What it means                                                                                            |
| ------ | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `403`  | `Insufficient permissions`                                                              | Your role can't do this. See [Team and Roles](/hinkal/hinkal-partner/getting-started/team-and-roles.md). |
| `403`  | `This action needs a recent sign-in. Sign out and sign back in to continue`             | Sign out, sign in and try again.                                                                         |
| `409`  | `You can have up to 10 API keys`                                                        | Revoke a key you don't use. Turned-off keys still count.                                                 |
| `409`  | `A key can have up to 10 allowed origins`                                               |                                                                                                          |
| `400`  | `Enter a valid https origin, for example https://app.example.com`                       |                                                                                                          |
| `409`  | `This user already belongs to a partner account`                                        | They have to leave their current company first.                                                          |
| `400`  | `Amount is more than your available balance`                                            | Pending payouts are already held back.                                                                   |
| `429`  | `Too many failed codes. Use the link we emailed you to unlock two-factor verification.` |                                                                                                          |
| `429`  | `Too many failed codes. Try again in 30 minutes.`                                       | Wallet-only accounts.                                                                                    |
| `401`  | `Verification expired, please sign in again`                                            | The 5-minute 2FA window passed.                                                                          |

***

### Limits

| What                                         | Limit                                              |
| -------------------------------------------- | -------------------------------------------------- |
| API keys per company                         | 10, including turned-off keys                      |
| Allowed origins per key                      | 10                                                 |
| Key name                                     | 50 characters                                      |
| Company name, your name                      | 1–64 characters                                    |
| Partner fee                                  | 0–100 bps, whole numbers                           |
| Key, fee and origin changes reaching the API | Up to about 60 seconds                             |
| Sign-in session                              | 12 hours                                           |
| Recent sign-in window                        | 10 minutes                                         |
| 2FA code window at sign-in                   | 5 minutes                                          |
| Wrong 2FA codes before lock                  | 10                                                 |
| Invite lifetime                              | 7 days                                             |
| Invite emails per company                    | 20 per 24 hours                                    |
| Invite resend                                | Once per 60 seconds                                |
| Payout amount                                | Up to 6 decimals, or the token's decimals if fewer |
| CSV export                                   | 10,000 rows                                        |

***

### Rate limits

Counted per 15 minutes. Going over returns `429`.

| What                                           | Limit | Counted per |
| ---------------------------------------------- | ----- | ----------- |
| API key actions (create, reveal, edit, revoke) | 30    | Company     |
| Payout requests                                | 20    | Company     |
| CSV exports                                    | 30    | Company     |
| Invites and resends                            | 30    | Company     |
| 2FA codes                                      | 10    | User        |
| Sign-in calls                                  | 30    | IP address  |
| Sign-up calls                                  | 30    | IP address  |