The ceiling follows the plan, not the key: every key an organisation holds is bounded by the
same number, and each is counted on its own — so a batch job and an interactive integration can be
given a key each and neither can starve the other.
Every successful authenticated response carries
RateLimit-Limit, RateLimit-Remaining and
RateLimit-Reset, so you can watch your allowance drain without being refused first; a
429 carries them too, and adds Retry-After.
The sandbox gets the same number as production, deliberately. A rehearsal at a rate you will
never be allowed to use makes a 429 rarer in rehearsal than in production — which is exactly
backwards for the one code path a sandbox exists to exercise. Matching them means an integration
that passes in the sandbox passes live, and that its retry handling is exercised where a 429 costs
nothing.