secondary rate limit

[chkmalu]

Select Topic Area

Question

Body

Hello,
I've been hitting this rate limit for the past 4 days now while trying to set up some environment variables using GitHub CLI, and I don't know how to get past it. Can someone help or advise me on what to do, please? Note that I've not been trying for the past 3days now to avoid extending the limit time. Here's the error I'm getting below

error occurred:
* failed to set variable "SOME_VARS": HTTP 429: 429 Too Many Requests (https://api.github.com/repositories/xxxxx/environments/development/variables)

[mayankgautam-dev]

GitHub Secondary Rate Limit - Troubleshooting Guide

GitHub is blocking your request because it thinks you're making too many API calls. This is called a secondary rate limit.

What to do:

1. Make sure no script or CI job is retrying

   • Check for any automated processes that might be repeatedly calling the GitHub API

2. Wait 24–72 hours after the last request

   • Secondary rate limits are temporary and usually reset within this timeframe

3. Check login with gh auth status

   gh auth status

4. Use a valid Personal Access Token

   • Ensure your token hasn't expired and has the necessary permissions

5. Try setting the variable once from GitHub web UI

   • Instead of using the API, try making the change directly through github.com

6. If it still fails after 4 days, contact GitHub Support

   • Visit GitHub Support for assistance

---

Note: This is temporary, just a bit frustrating. The rate limit will reset automatically.

[ohhaus]

You've hit a hard rate limit on the GitHub API, not the standard temporary one. The 429 error persisting for days means you've exceeded a stricter, separate limit for administrative repository actions—like managing environment variables. Stop all automated calls immediately.

Here is what you must do:

1. Cease All API Calls Immediately
   Stop every script, CI/CD pipeline, and CLI command that touches the GitHub API for that repository. This includes not just gh variable set, but any gh command, curl call, or action that uses your token. Let the system cool down for at least 24 hours with zero activity.

2. Audit Your Token Usage
   Check where your personal access token (PAT) or GitHub App is being used. A misconfigured script or loop in a CI job is the likely culprit. Revoke any token you suspect is overused and create a new one with minimal permissions.

3. Understand the Limits
   You are likely confusing two limits:

Core Rate Limit: ~5,000 requests per hour for authenticated users. This resets quickly.

Stricter Administrative Limits: Much lower thresholds for write operations (like POST/PATCH/PUT to repository variables, secrets, or settings). This is the "secondary rate limit" you've triggered, and the cooldown is longer.

4. Implement a Fix
   If you need to restore access urgently, you must change your architecture:

Cache Variables Locally: Instead of reading/writing via API in a loop, store configs locally in your runner or script.

Batch Operations: If you must set many variables, do it in a single job step, not across multiple jobs or steps. Consider storing multiple values as a single JSON variable.

Use GitHub Variables/Secrets UI: For one-time setup, use the web interface at Settings > Secrets and variables > Actions.

For Critical Systems: If this is for production, you need GitHub Enterprise, which has significantly higher rate limits.

The platform is telling you your automation is abusive. You must make it less chatty. There is no "waiting it out" if your scripts are still running. Stop everything, find the faulty process, and redesign it to make fewer requests.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬