2026-10-13

Handle 429s Without Retry Storms

Production guide: Handle 429s Without Retry Storms. It includes a deterministic artifact, failure boundaries, rollout checks, and source-qualified limitations.

Decision first

Handle 429s Without Retry Storms is an explicit production contract, not an isolated code change. Define the success signal, terminal failure state, and rollback condition before moving traffic. The artifact below separates evidence from assumption and keeps every attempt attributable.

Start with classification, prove retry_after under a deterministic case, and make terminal a release gate rather than a follow-up task.

The reusable artifact

Use this table as the review record. A row passes only when its evidence comes from the same request, test window, or configuration snapshot.

Checkpoint	Evidence to capture	Pass condition
`classification`	`429_source:_application,gateway,provider,or_shared_pool`	The record joins to one logical request and one concrete attempt.
`retry_after`	`delta-seconds_or_HTTP-date_parsed_against_a_monotonic_deadline`	The value is exact, preserved, and compared at the wire boundary.
`jitter`	`bounded_random_delay_after_server_guidance`	The limit is explicit and the request fails closed when it is exceeded.
`attempts`	`one_end-to-end_attempt_budget_shared_by_every_layer`	The limit is explicit and the request fails closed when it is exceeded.
`concurrency`	`admission_reduced_before_retry_volume_grows`	The limit is explicit and the request fails closed when it is exceeded.
`terminal`	`final_429_returned_with_request_ID_and_no_hidden_retries`	The owner, source, checked date, and known limitation are recorded.

Worked example

The example is synthetic and deterministic. Replace identifiers and thresholds with reviewed values from your own workload; never paste production secrets or customer prompts into a test fixture.

attempt_budget = 3
for attempt in 1..attempt_budget:
  result = call_once()
  if result.status != 429: return result
  if request.deadline_expired(): break
  delay = parse_retry_after(result.headers) ?? bounded_backoff(attempt)
  reduce_admission_concurrency()
  wait(min(delay + full_jitter(), request.remaining_time))
return terminal_429_without_another_retry()

Implementation procedure

Freeze the current request, response, configuration, and observable baseline before changing behavior.
Run one deterministic positive case and retain the complete client-visible result.
Run the paired negative or limit case so failure behavior is proved rather than inferred.
Join every attempt to one logical request ID, then record timing, terminal state, and usage without sensitive content.
Roll out through a bounded cohort with explicit stop conditions; do not widen traffic merely because the happy path passed.
Re-read the durable state and public behavior after the change, and execute the prepared rollback if any invariant fails.

Failure modes

The following failures invalidate the result even when the outer HTTP request appears successful:

Independent retry layers multiply attempts and turn a small 429 episode into sustained overload.
Client cancellation does not reach queued work or the active upstream request, consuming capacity after the result is useless.
A single text response is treated as proof of protocol compatibility across streaming, tools, schema, usage, and errors.
Prompts, credentials, raw tool arguments, or provider payloads are copied into high-cardinality telemetry.

Modelflare boundary

Modelflare can centralize OpenAI-compatible routing, keys, groups, usage records, and failure handling, but a configured route is not proof that every upstream supports every optional field. Verify the selected model and channel with the native protocol path. Keep provider prices in the current pricing source, preserve explicit zero values, and treat the final durable settlement—not an estimate—as billing truth.

Use the parent guide for the broader decision boundary and the setup documents for current client configuration.

Publication checklist

The main question is answered before background material.
Every request field, status, metric, and formula has one named owner.
Examples use synthetic identifiers and contain no credential or customer data.
All supported locales preserve the same headings, tables, code, limits, and caveats.
Volatile API contracts, model support, and prices are rechecked at T-1 day; an invalidated claim moves the publication date.
Before the scheduled time, the public API, localized routes, and sitemap still exclude the article.

Sources and verification date

Sources were checked on 2026-08-07. They establish the external contract or operating principle; they do not prove support on an untested provider route.