--- title: "Rate limits and keys: Operating a contact lookup API in production – Invenitor" description: "Rate limits and keys: operating a contact lookup API in production – key hygiene, 429 backoff, and found-only credits when enrichment is live." url: https://invenitor.com/blog/rate-limits-and-keys-operating-a-contact-lookup-api-in agents: https://invenitor.com/llms.txt mcp: https://api.invenitor.com/mcp --- [Blog](https://invenitor.com/blog) Oct 19, 2026 · 9 min read · API # Rate limits and keys: Operating a contact lookup API in production Rate limits and keys: operating a contact lookup API in production – key hygiene, 429 backoff, and found-only credits when enrichment is live. On this page 1. [Keys: store, rotate, scope](#keys-store-rotate-scope) 2. [Rate limits: design for 429](#rate-limits-design-for-429) 3. [Credits are not the same as HTTP calls](#credits-are-not-the-same-as-http-calls) 4. [Observability that PMs care about](#observability-that-pms-care-about) 5. [MCP and agents share the same pool](#mcp-and-agents-share-the-same-pool) 6. [Commercial operations](#commercial-operations) 7. [What should you do next?](#what-should-you-do-next) 8. [Incident playbook (short)](#incident-playbook-short) 9. [Staging checklist](#staging-checklist) Shipping a contact lookup into production is less about a demo cURL and more about **keys, quotas, and failure modes**. Products that bolt enrichment on day one often leak keys in browser bundles, retry forever on 429, or treat every HTTP call as a billable event. Operating Invenitor well means the opposite: A people search and lookup API, not a sales cloud and production hygiene. Hub: [LinkedIn or GitHub Profile URL → Contact Lookup API](https://invenitor.com/blog/linkedin-github-contact-lookup-api). GitHub spoke: [GitHub Profile URL Contact Lookup](https://invenitor.com/blog/github-profile-url-contact-lookup-when-developer-profiles-are-the). Layer: [Contact Lookup API vs CRM vs Sequencer](https://invenitor.com/blog/contact-lookup-api-vs-crm-vs-sequencer-pick-the-right). ## Keys: store, rotate, scope | Practice | Do | Don't | | -------- | ---------------------------------- | ------------------------------ | | Storage | Server env / secret manager | Frontend bundle, public repo | | Rotation | Rotate on staff exit and quarterly | Share one eternal key in Slack | | Scope | One key per environment | Same key for staging + prod | ## Rate limits: design for 429 Rate limits protect shared capacity. When you hit a limit, back off with jitter – do not spin a tight retry loop that looks like abuse. Queue shortlists; process in batches. ## Credits are not the same as HTTP calls Demand that contract in writing – [What Are API Credits in Enrichment Products?](https://invenitor.com/blog/what-are-api-credits-in-enrichment-products), [What Is Pay-Per-Lookup Pricing?](https://invenitor.com/blog/what-is-pay-per-lookup-pricing). Coverage: coverage varies; we do not publish hit-rate percentages. ## Observability that PMs care about - Alert on key 401 spikes (rotation / leak). - Alert on sustained 429 (batch size too aggressive). - Keep primary contact fields honest. ## MCP and agents share the same pool Agents calling lookup via MCP must use the same key hygiene and credit pool as REST – , [Claude / Cursor Agents](https://invenitor.com/blog/claude-cursor-agents-calling-a-contact-lookup-mcp-endpoint), [Agent-Readable Docs](https://invenitor.com/blog/agent-readable-docs-why-mcp-md-matters-for-contact-apis), ## Commercial operations INR packs, Razorpay/UPI, 30-day windows – [INR Credit Packs](https://invenitor.com/blog/inr-credit-packs-for-contact-lookup-how-razorpay-pricing-feels), [25 to 1,000 Credits](https://invenitor.com/blog/25-to-1-000-credits-choosing-an-inr-pack-size), . Trust: [Trust Checklist Before You Buy Any Contact API](https://invenitor.com/blog/trust-checklist-before-you-buy-any-contact-api). ## What should you do next? Put the key in a secret manager. Confirm ledger vs found-only billing. Size a pack on . Wire agents only after is in the runbook. ## Incident playbook (short) ## Staging checklist Separate key. Layer: [Contact Lookup API vs CRM vs Sequencer](https://invenitor.com/blog/contact-lookup-api-vs-crm-vs-sequencer-pick-the-right). Commercial: [INR Credit Packs](https://invenitor.com/blog/inr-credit-packs-for-contact-lookup-how-razorpay-pricing-feels), [Razorpay, UPI, Cards, Wallets](https://invenitor.com/blog/razorpay-upi-cards-wallets-payment-reality-for-india-api-buyers). ## Questions Where should API keys live?+ Server-side secret storage – not browser bundles, mobile apps, or public repos. What should we do on HTTP 429?+ Back off with jitter, queue the shortlist, and reduce batch concurrency. Do not tight-loop retries. Do rate-limit errors spend credits?+ They should not. Can staging and production share one key?+ Prefer separate keys per environment so a staging leak does not burn production capacity. How do agents affect rate limits?+ MCP tools share the same pool and limits as REST – configure concurrency in the agent, not by scraping. Where is the integration guide?+ /docs for REST, /mcp.md for agents, /pricing for packs. How does this relate to CRM architecture?+ See Adding Contact Lookup to a CRM and REST Enrichment Inside a Product for auth and sync patterns. ## Find the person you need Describe who you need in one sentence. Your first search is free, and you pay only for contacts we find [Find people free](https://invenitor.com/login?from=https%3A%2F%2Fpeople.invenitor.com%2Fsearch&x=w7&q=c5&z=g1)[See pricing](https://invenitor.com/pricing?x=w7&q=c5&z=g2) ## Keep reading - [Nov 3, 2026 · APINames help too: How optional full name improves lookup requestsNames help too: how optional full name improves lookup requests – URL remains primary; name is a soft hint; empties stay empty under coverage.](https://invenitor.com/blog/names-help-too-how-optional-full-name-improves-lookup-requests) - [Oct 27, 2026 · APIError codes buyers should expect from a lookup APIError codes buyers should expect from a lookup API – auth failures, rate limits, validation, and server faults – with honest empty vs error billing semantics.](https://invenitor.com/blog/error-codes-buyers-should-expect-from-a-lookup-api) - [Oct 12, 2026 · APIContact lookup API vs CRM vs sequencer: Pick the right layerContact lookup API vs CRM vs sequencer: pick the right layer – find contacts from profile URLs without buying a sales cloud or dialer stack.](https://invenitor.com/blog/contact-lookup-api-vs-crm-vs-sequencer-pick-the-right)