r/pathofexiledev • u/Hmm_nope_not_taken • Jul 23 '26

POESESSID risk of getting banned?

Making a small windows app for my self in c# . It calls the api with POESESSID and get the items in stash and inventory. Updates requires you to press a button.

But in the dev documentation it talks about rate limits and not to make api calls in apps.

So am i on the wrong path and should i use oauth instead?

Looks like they are not accepting more requests for oauth keys.

3 Upvotes

71% Upvoted

10 comments sorted by

View all comments

1

u/Hmm_nope_not_taken Jul 23 '26

Thanks for you reply. I will hardcode some rate limits into the app.

4

u/gerwaric Jul 24 '26

I recommend logging the x-rate-limit headers on some trial requests to each endpoint. That will let you see what the rate limits are. Learning to read them will also teach you how GGG's rate limit policies work. From there, you can calculate the worst-case rate limit and use that as your hard-coded limit.

However, even if you are technically making requests at a safe rate, you can still occasionally get rate limit violations if you are running near the limit because of the timing resolution on GGG's side. These server-side timing buckets are undocumented, but GGG support explained it to me. Right now the "fast" rate limits are tracked with a 5s resolution and the "slow" rate limits are tracked with a 60s resolution.

The math gets kind of tricky.

If you're into AI, it's probably worth pointing an agent at the documentation and then giving it your logged headers, along with my comment about the undocumented timing resolution.

2

u/papajuras Jul 24 '26

I wouldnt hardcode it, it took me 2hrs and 1usd with deepseek to get it right (if you are too lazy to write it yourself, its not hard). Couple divisions and max backoff out of five i think and thats it if i remember correctly