Quick answer: GitHub API has multiple independent constraints. Match the exact plan, model, runtime, invocation mode, or server configuration shown in each row.
Current documented limits
| Constraint | Current value | Scope | Verified source |
|---|---|---|---|
| Unauthenticated REST requestsApplies when fetching public data without authentication. | 60 requests per hour | Originating IP address | GitHubAug 22, 2026 |
| Authenticated personal REST requestsSome GitHub Enterprise Cloud app and OAuth contexts have higher limits; search and GraphQL use separate constraints. | 5,000 requests per hour | Authenticated user | GitHubAug 22, 2026 |
How to apply GitHub API limits safely
The monitored baseline covers Unauthenticated REST requests, Authenticated personal REST requests. Treat these as separate constraints rather than one platform-wide capacity number: a workload can fit one row and still fail another because the plan, model, endpoint, runtime, region, invocation mode, or account scope differs.
- Match the production workload to the exact scope printed beside each value and confirm it in the active GitHub API console, configuration, or response headers.
- Measure the serialized request, token volume, duration, concurrency, storage, or connection demand at realistic percentiles, then preserve headroom for bursts and retries.
- Check every adjacent layer—client, SDK, gateway, proxy, queue, database, and downstream service—for a smaller effective limit before changing architecture.
Specific limit pages
These pages exist because the constraint has a distinct implementation or troubleshooting intent. Closely related keyword variations stay consolidated.