# GitHub Actions: HttpError: API rate limit exceeded for installation ID 123456 / secondary rate limit

**Code:** `API rate limit exceeded` · **Category:** CI/CD · **Seen on:** GitHub Actions

Your workflow (or an action it uses) made too many GitHub API calls and was throttled with 403/429.

## Meaning

`GITHUB_TOKEN` has a per-repository hourly limit (1,000 requests) and all runs share it; unauthenticated calls from the runner IP hit tight limits. Cache results, reduce calls, add retries with back-off, and use a PAT or GitHub App token with a higher limit for heavy automation.

## Common causes

- Many API calls per run (looping over issues, releases or files)
- Many parallel runs sharing the same token budget
- Unauthenticated requests (no token passed)
- Secondary rate limit from rapid-fire writes (comments, labels)
- Third-party action polling the API

## Quick fix

1. Pass `GITHUB_TOKEN` to the action and reduce calls
2. Add sleeps and retries (`Retry-After` header)
3. Use a GitHub App or PAT for high-volume jobs

## Detailed fix by platform

### GitHub Actions

1. Check remaining quota: `run: gh api rate_limit` with `env: GH_TOKEN: ${{ github.token }}`
2. Batch writes with the GraphQL API

## Code examples

### Authenticated gh with a quota check

```yaml
- name: Rate limit
  env:
    GH_TOKEN: ${{ github.token }}
  run: gh api rate_limit --jq '.resources.core'
```

## How to diagnose

1. **Quota** — What does rate_limit show?
2. **Auth** — Token passed to the call?
3. **Concurrency** — Many runs at once?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/cicd/gha-api-rate-limit-exceeded)