# Rate limits 
To prevent Xsolla system overloads and protect against sudden spikes in incoming traffic, Xsolla limits the number of requests received by the Xsolla API within a specified period of time. If the limit is exceeded, the Xsolla API returns an HTTP response with the `429` status code.
Rate limits vary by method, IP-address, authentication scheme, and other factors.
Rate limits for server-side methods are applied to methods with server-side authentication — methods that are called with the `X-SERVER-AUTHORIZATION: <server_JWT>` header, where `<server_JWT>` is the server token.
Rate limits for client-side methods are applied to methods without authentication or with client-side authentication — methods that are called with the `Authorization: Bearer <user_JWT>` header, where `<user_JWT>` is the user token.
**Example of a method with server-side authentication:**
![Example of a method with server-side authentication](https://cdn.xsolla.net/developers/current/images/api_docs/login-rate-limits-1.png)
**Example of a method with client-side authentication:**
![Example of a method with server-side authentication](https://cdn.xsolla.net/developers/current/images/api_docs/login-rate-limits-2.png)
Rate limits for client-side methods do not change and are necessary to prevent brute-force attacks. The maximum request rate for server-side methods is higher than for client-side methods.
You can refer to the recommendations on how to manage rate limits in the [documentation](https://developers.xsolla.com/api/getting-started/#api_rate_limits).
**Note**
In certain cases, it is possible to adjust the rate limits by request. To request the rate limits adjustment, contact your Customer Success Manager or email [csm@xsolla.com](mailto:csm@xsolla.com).