| Scope | Default | Applied to |
| OAuth application | 100 requests per 60 seconds | Matching Twilio-compatible API requests with a bearer token |
| Account | 30 requests per 60 seconds | POST /2010-04-01/Accounts/:sid/Calls.json |
| IP address | 300 requests per 300 seconds | Sign-in and OAuth routes |
.json API paths; do not assume every endpoint or URL variant has the same throttle. The implementation currently uses an in-process memory store, so counters are not shared across Puma workers or hosts.429 with a Retry-After header. Respect that header and retry with backoff.