Every Org API key has a rateLimitPolicy ({ limit, windowSeconds }, default { limit: 5000, windowSeconds: 3600 }; see DEFAULT_ORG_API_RATE_LIMIT in apps/web/src/lib/org-api/types.ts) that's enforced with a fixed window in apps/web/src/lib/org-api/rate-limit.ts. See Errors → Rate limit headers for the exact X-RateLimit-*/Retry-After headers and the 429 RATE_LIMITED error shape.

TODO(owner, likely engineering + product): write the full page from apps/web/src/lib/org-api/rate-limit.ts and confirm whether individual keys can be issued a non-default policy (and if so, who sets it and where it's surfaced in Settings) before publishing guidance on requesting a higher limit.