diff --git a/doc/api/fundamentals.rst b/doc/api/fundamentals.rst
index 7a297ab1fb..281a0f6336 100644
--- a/doc/api/fundamentals.rst
+++ b/doc/api/fundamentals.rst
@@ -148,6 +148,7 @@ Field specific input errors include the name of the offending fields as keys in
 
    {"amount": ["A valid integer is required."], "description": ["This field may not be blank."]}
 
+If you see errors of type ``429 Too Many Requests``, you should read our documentation on :ref:`rest-ratelimit`.
 
 Data types
 ----------
diff --git a/doc/api/index.rst b/doc/api/index.rst
index 674077f2d0..2c0a9ba84b 100644
--- a/doc/api/index.rst
+++ b/doc/api/index.rst
@@ -16,4 +16,5 @@ in functionality over time.
    fundamentals
    auth
    resources/index
+   ratelimit
    webhooks
diff --git a/doc/api/ratelimit.rst b/doc/api/ratelimit.rst
new file mode 100644
index 0000000000..10b3e3a80a
--- /dev/null
+++ b/doc/api/ratelimit.rst
@@ -0,0 +1,31 @@
+.. _`rest-ratelimit`:
+
+Rate limiting
+=============
+
+.. note:: This page only applies to the pretix Hosted service at pretix.eu. APIs of custom pretix installations do not
+          enforce any rate limiting by default.
+
+All authenticated requests to pretix' API are rate limited. If you exceed the limits, you will receive a response
+with HTTP status code ``429 Too Many Requests``. This response will have a ``Retry-After`` header, containing the number
+of seconds you are supposed to wait until you try again. We expect that all API clients respect this. If you continue
+to burst requests after a ``429`` status code, we might get in touch with you or, in extreme cases, disable your API
+access.
+
+Currently, the following rate limits apply:
+
+
+
+.. rst-class:: rest-resource-table
+
+===================================== =================================================================================
+Authentication method                 Rate limit
+===================================== =================================================================================
+:ref:`rest-deviceauth`                360 requests per minute per device
+:ref:`rest-tokenauth`                 360 requests per minute per organizer account
+:ref:`rest-oauth`                     360 requests per minute per combination of accessed organizer and OAuth application
+Session authentication                *Not an officially supported authentication method for external access*
+===================================== =================================================================================
+
+If you require a higher rate limit, please get in touch at support@pretix.eu and tell us about your use case, we are
+sure we can work something out.