# Bearer Tokens, Pagination and Rate Limits, in Plain Words > Read an API doc before you build: where a bearer token goes, how pagination works, and what 401, 429 and 500 mean for your workflow. Free 8-minute lesson. Source: https://learn.ynteractive.com/content/bearer-token-pagination-rate-limits · Updated 2026-10-20 · Free from Stepthrough (https://learn.ynteractive.com) ## Practice it step by step [Start the free practice](https://learn.ynteractive.com/modules/api-auth-pagination-rate-limits) [Take the free module: why it matters, practice and a quick check →](https://learn.ynteractive.com/courses/web-data-automations/6) You do every step yourself in a practice copy of Stepthrough. It checks your work as you go, and “Do it for me” finishes any step you get stuck on. Free, about 8 minutes, and nothing touches your real accounts. [Open full screen](https://learn.ynteractive.com/modules/api-auth-pagination-rate-limits) Free · Live now · [AI Basics](https://learn.ynteractive.com/content/course/ai-basics) · [Stepthrough](https://learn.ynteractive.com/content/tool/stepthrough) · ~8 min · 18 steps · Intermediate Updated October 20, 2026. Built against the tool’s current screens and checked step by step. [How we check this lesson](https://learn.ynteractive.com/content/about#how-we-check) Sending one [API](https://learn.ynteractive.com/content/glossary/api) request is easy. Real API workflows break on three other things: a key put where it leaks, a sheet that quietly stops at 100 rows, and a run that fails at 2am because it asked too fast. In this free, hands-on lesson you read an example API doc and work through bearer tokens, pagination and [rate limits](https://learn.ynteractive.com/content/glossary/rate-limit) with [status codes](https://learn.ynteractive.com/content/glossary/http-status-code), on simple worksheets with nothing to sign up for. ## At a glance | Question | Answer | | --- | --- | | What you build | Read an example API doc before you build: put the key in a bearer token credential, follow pagination past page one, and know what to do with a 401, 429 or 500. | | Tools | Stepthrough | | Time | About 8 minutes, 18 steps in 4 parts | | Level | Intermediate | | Cost | Free | | Ways to learn it | [Practice it step by step](https://learn.ynteractive.com/modules/api-auth-pagination-rate-limits) | ### The 4 parts, in short 1. Read the doc: Read Authentication, Read the endpoint, Read the parameters, Read the rate limit. 2. Bearer tokens: Open Bearer tokens, Look at the key in the URL, Look at a saved credential, Where does the key go?. 3. Pagination: Open Pagination, Request 1, Request 2, The last page, and 1 more step. 4. Rate limits and errors: Open Rate limits, 401 Unauthorized, 429 Too Many Requests, 500 Server Error, and 1 more step. **Start here first:** [Start Here: How Stepthrough Works](https://learn.ynteractive.com/content/how-stepthrough-works) (module 1 of AI Basics) **Part of:** [Business Automations with n8n](https://learn.ynteractive.com/content/paths/business-automations-n8n) (step 9 of 22). Next up: [Litescrape in n8n: Swap SerpApi for a Cheaper Search API](https://learn.ynteractive.com/content/litescrape-n8n-serpapi-alternative) **Part of:** [Get Data From the Web Into Your Automations](https://learn.ynteractive.com/content/paths/web-data-automations) (step 5 of 9). Next up: [What Is a Webhook? Send a Test and Watch the Data Arrive](https://learn.ynteractive.com/content/what-is-a-webhook) **Part of:** [n8n Intermediate: Real Business Workflows](https://learn.ynteractive.com/content/paths/n8n-intermediate) (step 5 of 17). Next up: [n8n + Felo: A Monday Research Brief With a Source for Every Answer](https://learn.ynteractive.com/content/n8n-felo-api-weekly-research-brief) ## What you will do The example is Copperleaf Marketing, a made-up agency that wants every client contact from its CRM in a Google Sheet each night. You read the sections of a made-up API doc (authentication, the endpoint, parameters, the rate limit and error codes), decide where the key goes, follow pagination through four requests to get all 340 contacts, and decide what the workflow should do with each status code. ## What is a bearer token? A bearer token is an API key sent in the Authorization header, as the word Bearer, a space and the key. It works for whoever holds it, like a hotel key card, so where you put it matters. Keep it out of URLs, which end up in logs, screenshots and shared links. Store it once as a credential in your automation tool (in [n8n](https://learn.ynteractive.com/content/tool/n8n), a Bearer Auth credential), and if it ever leaks, revoke it and create a new one. ## What is API pagination? Most APIs return big lists one page at a time, such as 100 records, plus a cursor or page number for the next page. Your workflow sends the same request again with that cursor until there is no next one. If a sheet always has exactly 100 rows, or any other round number, the workflow is only reading page one. n8n's HTTP Request node has a Pagination option that does the loop for you. ## Rate limits and status codes A rate limit caps how many requests you may send, such as 60 a minute. Over it, the API answers 429 Too Many Requests, often with a Retry-After header saying how long to wait. Read the status code before you decide what to do: 200 means carry on, 401 means the key is wrong and a person has to fix it, 429 means wait and retry, and 500 means a problem on their side, so retry a few times and then alert someone. ## How the interactive lesson works Each step is shown first in the Watch panel, then you do it yourself in Your turn on a [Stepthrough](https://learn.ynteractive.com/content/tool/stepthrough) worksheet. The CRM and its doc are made up and no request is sent. It is part of the free course Get Data From the Web Into Your Automations, right after the module where you send your first GET and POST with n8n's HTTP Request node. ## Try it yourself, free Reading the steps is a start. Doing them is how it sticks. The interactive module walks you through every click in a practice copy of Stepthrough, checks each step, and never touches your real accounts. [Start “Bearer Tokens, Pagination and Rate Limits, in Plain Words”](https://learn.ynteractive.com/modules/api-auth-pagination-rate-limits) ## Step by step: Bearer Tokens, Pagination and Rate Limits, in Plain Words All 18 steps of the interactive module, in order. In the module you watch each one, then do it yourself in a practice copy that checks your work. ### 1. Read the doc 1. **Read Authentication.** Click the **Authentication** section. Sam wants every client contact from the agency's CRM in a sheet, every night. Before you build anything, read the API doc. Start with authentication. 2. **Read the endpoint.** Click **GET /v1/contacts**. The key goes in a header called Authorization, after the word Bearer. Next, the endpoint. 3. **Read the parameters.** Click the **Parameters** section. GET slash v1 slash contacts. That reads contacts. Now the parameters. This line hides an important clue. 4. **Read the rate limit.** Click the **Rate limit** section. A hundred at most, and a cursor for the next page. So you'll need more than one request. Last, the rate limit. ### 2. Bearer tokens 5. **Open Bearer tokens.** Click the **Bearer tokens** tab. Sixty requests a minute. Go faster and the API tells you to slow down. Now, the key. 6. **Look at the key in the URL.** Click the **In the URL** card. A bearer token works for whoever holds it. Like a hotel key card. So look at this one. The key is in the URL. 7. **Look at a saved credential.** Click the **In a saved credential** card. Avoid that. URLs end up in logs and screenshots. The best place is a saved credential. 8. **Where does the key go?.** Answer the question: where should the Tidewater key go? You paste the key once, and the tool keeps it encrypted. So where should the key go in n8n? ### 3. Pagination 9. **Open Pagination.** Click the **Pagination** tab. In a Bearer Auth credential. Now, those hundred-at-a-time pages. 10. **Request 1.** Click **Request 1**. The CRM has three hundred and forty contacts. The first request gets a hundred, and a next cursor. 11. **Request 2.** Click **Request 2**. The second request sends that cursor back, and gets the next hundred, and a new cursor. 12. **The last page.** Click **Requests 3 and 4**. Keep going until the cursor is empty. That's the last page. In n8n, the HTTP Request node has a pagination option that does this loop for you. 13. **Why only 100?.** Answer the question: why does the sheet only have 100 contacts? Here is a bug you will see in real life. The sheet always has exactly a hundred contacts. Why? ### 4. Rate limits and errors 14. **Open Rate limits.** Click the **Rate limits** tab. A round number like a hundred is the giveaway. Last part. 15. **401 Unauthorized.** Click **401 Unauthorized**. Every response has a status code. Two hundred means it worked. Four oh one means the key is wrong. Retrying will not help. A person has to fix it. 16. **429 Too Many Requests.** Click **429 Too Many Requests**. Four twenty nine means too fast. Wait, and try again. 17. **500 Server Error.** Click **500 Server Error**. Five hundred means something broke on their side. Usually it's temporary. 18. **Fix the 2am failure.** Answer the question: what do you change after a 429 at 2am? The nightly run fails at two in the morning, with a four twenty nine. What do you change? ## Frequently asked questions **What is a bearer token?** An API key sent in the Authorization header as "Bearer" followed by the key. Anyone who has it can use it, so keep it in a saved credential and never put it in a URL. **Why does my API only return 100 results?** The API returns results one page at a time. Your workflow reads the first page only. Follow the next cursor or page number, or turn on pagination in the HTTP Request node. **What does error 429 mean?** Too Many Requests: you hit the API's rate limit. Wait for the time in the Retry-After header and try again, and space your requests out so it does not happen every run. **What is the difference between a 401 and a 429 error?** 401 means the key is wrong, expired or missing, and retrying will not help. 429 means the key is fine but you sent requests too fast, so waiting and retrying fixes it. **Is this lesson free?** Yes. Stepthrough is free and the practice needs no account. [Start this module free](https://learn.ynteractive.com/modules/api-auth-pagination-rate-limits) - Previous in AI Basics: [APIs vs Scraping vs RSS: Pick the Right Way to Get Web Data](https://learn.ynteractive.com/content/api-vs-web-scraping-vs-rss) - Next in AI Basics: [Prompting for Slides: Outline, Brand Kit, Check the Numbers](https://learn.ynteractive.com/content/prompting-ai-slides-outline-brand-kit) ## More in AI Basics - [Start Here: How Stepthrough Works](https://learn.ynteractive.com/content/how-stepthrough-works): Try the practice in under two minutes: watch a step, click, type, get unstuck with Do it for me, and finish. - [AI Agent vs Chatbot vs Automation: One Job Done Three Ways](https://learn.ynteractive.com/content/ai-agent-vs-chatbot-vs-automation): Chase six unpaid invoices three ways: a chatbot writes a template, an automation follows a rule, and an AI agent works out the steps and flags the tricky one. - [What Is a Webhook? Send a Test and Watch the Data Arrive](https://learn.ynteractive.com/content/what-is-a-webhook): Point a plumber's website contact form at a free webhook tester, send a test and a real message, and watch the data arrive the moment it's sent. - [Automation Basics: Triggers, Actions and Data Mapping](https://learn.ynteractive.com/content/automation-triggers-actions-mapping): Learn the three ideas behind every n8n workflow, Make scenario and Zap: a trigger starts it, actions do the jobs, and data mapping carries the details. Fix the classic… - [When to Add AI to an Automation (n8n, Make or Zapier)](https://learn.ynteractive.com/content/when-to-add-ai-to-automation): Sort six office jobs into plain rules, AI steps and human decisions, then see the safe shape of an AI automation and how n8n, Make and Zapier each add the AI step. - [Use AI at Work Without Leaking Client Data using ChatGPT](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste): Turn off model training, strip a tenant's bank details and address out of a prompt, then catch the two promises ChatGPT made up before the reply goes out. [All 22 modules in AI Basics](https://learn.ynteractive.com/content/course/ai-basics) ## More Stepthrough tutorials - [How AI Answers from Your Documents: Retrieval (RAG) Explained](https://learn.ynteractive.com/content/how-ai-answers-from-your-documents): Follow one customer question through a support bot: files cut into chunks, a search by meaning, the AI told to answer only from what it found, and a safe fallback when… - [AI Support Bot Guardrails, Fallback Answers and Human Handoff](https://learn.ynteractive.com/content/ai-support-bot-guardrails-and-human-handoff): Write the rules for an insurance agency’s website bot, run five hard test chats (advice, a trick message, an upset customer) and design a handoff to a person that… - [How AI Reads a PDF: OCR, Document Parsing and Field Extraction](https://learn.ynteractive.com/content/how-ocr-and-document-parsing-work): Follow two vendor invoices, one digital and one scanned, through OCR, parsing rules vs AI extraction, and the four checks that stop a misread total from reaching your… - [How AI Transcription Works: Speech-to-Text, Speaker Diarization and Themes](https://learn.ynteractive.com/content/how-ai-transcription-works): Follow one recorded client call from sound to transcript, catch the kind of error speech-to-text makes, name the speakers, and pull out action items and themes you can… - [Safe AI Agents: Least Privilege, Approvals and Audit Trails](https://learn.ynteractive.com/content/safe-ai-agents-least-privilege-approvals-audit-trails): Set up the safety around a firm's inbox agent: strip the access it doesn't need, send client emails to a person, write rules a prompt can't talk past, and read the log. ## Terms in this lesson Plain-English definitions, each with an example from a free lesson. [API](https://learn.ynteractive.com/content/glossary/api) · [Rate limit](https://learn.ynteractive.com/content/glossary/rate-limit) · [HTTP status code](https://learn.ynteractive.com/content/glossary/http-status-code) · [Bearer token](https://learn.ynteractive.com/content/glossary/bearer-token) · [CRM](https://learn.ynteractive.com/content/glossary/crm) · [API key](https://learn.ynteractive.com/content/glossary/api-key) [The full AI glossary](https://learn.ynteractive.com/content/glossary) ## Browse related tutorials [AI Basics (22)](https://learn.ynteractive.com/content/course/ai-basics) · [Stepthrough tutorials (9)](https://learn.ynteractive.com/content/tool/stepthrough)