Network and limits
- Your wallet must answer within 5 seconds per call (§2.7). Aim for well under 1 second.
- GA doesn’t filter your source IP on the Operator API. If you restrict inbound traffic to your wallet, allow GA’s outbound addresses:
49.13.169.177and46.224.156.1for the sandbox,49.13.169.177for production. - GA enforces no request rate limit on the Operator API today. Keep catalog polling to once a minute or less and use
updated_since. GA reserves a429withERROR_CODE_RATE_LIMITEDfor abuse. - Secrets never go into source control, browser code, tickets, or logs.