# Rate limits for a multi-tenant OAuth app — how do they scale with connected merchants

**URL:** <https://developer.squareup.com/forums/t/rate-limits-for-a-multi-tenant-oauth-app-how-do-they-scale-with-connected-merchants/26925>\
**Category:** Questions\
**Tags:** sdk, booking-api\
**Created:** [July 22, 2026, 8:01am UTC](https://developer.squareup.com/forums/t/rate-limits-for-a-multi-tenant-oauth-app-how-do-they-scale-with-connected-merchants/26925 "2026-07-22T08:01:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![YasonStudio](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/yasonstudio/32/11981_2.png) [@YasonStudio](https://developer.squareup.com/forums/u/YasonStudio)\
**Post date:** [July 22, 2026, 8:01am UTC](https://developer.squareup.com/forums/t/rate-limits-for-a-multi-tenant-oauth-app-how-do-they-scale-with-connected-merchants/26925/1 "2026-07-22T08:01:44Z")

</div>

Hi everyone,

I’m building a multi-tenant online [booking widget](https://ibooker.online) for Square Appointments (Next.js app, one Square OAuth application, many independent merchants each connect their own Square account via Authorization Code + PKCE — no `APPLICATION_SECRET` stored anywhere, per Square’s recommended public-client flow). Each merchant gets their own booking page; the widget calls `Locations`, `Catalog`, `TeamMemberBookingProfiles`, `BusinessBookingProfile`, `SearchAvailability`, and `CreateBooking` on the merchant’s behalf using their access token.

Scopes requested: `APPOINTMENTS_READ`, `APPOINTMENTS_ALL_WRITE`, `APPOINTMENTS_WRITE`, `APPOINTMENTS_ALL_READ`, `APPOINTMENTS_BUSINESS_SETTINGS_READ`, `CUSTOMERS_READ`, `CUSTOMERS_WRITE`, `PAYMENTS_READ`, `PAYMENTS_WRITE`, `MERCHANT_PROFILE_READ`.

We recently hit:

```auto
Status 429
{ "errors": [{ "category": "RATE_LIMIT_ERROR", "code": "RATE_LIMITED",
  "detail": "Application is rate limited, please try again in a few minutes" }] }

```

during a burst of concurrent testing across a handful of connected merchants — this looked like an **application-wide** limit, not a per-merchant-token one.

A few questions as we plan for growth (currently a handful of merchants, aiming for hundreds):

1. Are rate limits enforced **per application** (aggregated across every connected merchant’s calls) or **per individual access token**? The error message and our own logs suggest application-wide, but I’d like to confirm.
2. What’s the process to request a limit increase for a growing app — is there a form, or should we go through Developer Support directly?
3. Any official guidance for multi-tenant platforms on staying under these limits at scale (e.g., recommended caching windows for `Locations`/`Catalog`, batching patterns, or a documented backoff strategy Square expects clients to implement)?

Thanks in advance — happy to share more detail about our usage pattern if it helps.

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [July 22, 2026, 7:07pm UTC](https://developer.squareup.com/forums/t/rate-limits-for-a-multi-tenant-oauth-app-how-do-they-scale-with-connected-merchants/26925/3 "2026-07-22T19:07:34Z")

</div>

Correct, rate limits are at the application level and may vary by endpoint. [Handling Errors](https://developer.squareup.com/docs/build-basics/general-considerations/handling-errors#rate-limiting-errors)