Limits
Rate limit
Each API key can make up to 120 requests per minute. Exceeding this limit returns 429:
{ "error": "Too Many Requests", "code": "RATE_LIMITED", "message": "Too many requests. Slow down." }
Wait one minute before retrying. There is also a broad per-IP limit of 1,200 requests per minute across all /api endpoints, which normal POS traffic will not hit.
Request body size
A request body can be at most 1 MB. Larger payloads return 413 PAYLOAD_TOO_LARGE. Till requests are orders of magnitude smaller than this limit.
Business program guardrails
The limits below are configured by the business owner on the Program rules (Program kuralları) page in the dashboard. Default values for a new business are:
| Setting | Default | When exceeded |
|---|---|---|
| Maximum purchase amount per transaction | 5,000 TL (500000 kuruş) | 422 AMOUNT_TOO_HIGH |
| Maximum earns per member per day | 5 earns | 429 DAILY_EARN_LIMIT |
| Maximum earns per cashier (API key) per day | 500 earns | 429 CASHIER_DAILY_LIMIT |
| Maximum points per transaction | 1,000 points | Awarded points are capped at this value (no error) |
| Maximum stamps per visit | 10 stamps | 422 TOO_MANY_STAMPS |
Daily counters reset at midnight Turkey time (Europe/Istanbul). You can inspect the active values for your business in the program object returned by GET /me.
High-value sale alerts
A business can configure a threshold for high-value sales. Transactions above that threshold are not rejected; they are flagged in the business's fraud & audit reports.
Subscription status
When a business's trial expires or its subscription is suspended, POST /scan returns 402 (TRIAL_EXPIRED or SUBSCRIPTION_SUSPENDED). Because scanning is blocked, neither earning nor redeeming can proceed until the owner activates their plan or contacts Mekante support.
QR & scan time windows
| Window | Duration |
|---|---|
| Customer QR token lifetime | 30 seconds |
Time to call /earn or /redeem after scan | 5 minutes |
| Cashier/API key void window | 15 minutes |