The per-key limit is 120 authorization/tool checks per minute, shared across access through that key. REST reads use one check; MCP tool requests normally use two.
MCP transport failures use an
error response; tool execution failures are returned with isError: true and a text explanation. Do not assume that an HTTP success means a simulated purchase succeeded. Read the tool result.