Market Data API: 401 & 429 Troubleshooting

Core Takeaway · 30-Second Brief

Inspect both the HTTP status code and the JSON ret field to separate authentication errors (invalid, expired, or mismatched endpoint token) from rate limiting (excessive QPS). Fix auth issues immediately without retrying; handle rate limits by batching symbols, switching real-time workloads to WebSocket, and applying jittered exponential backoff.

Step-by-Step Diagnostic Flow

1Log the full HTTP status code, response body, and UTC timestamp (redact your API Token).

2When ret != 200, inspect msg to determine whether the failure is authentication/permission or rate limiting.

3For auth errors: verify the token string has no trailing whitespace, newline characters, or truncation.

4For permission errors: confirm the endpoint matches the asset class (e.g., do not query forex tickers on quote-stock-b-api).

5For rate limits: measure actual requests per second across all workers against your plan tier limit.

Symptom-to-Cause Reference

Symptom	Most Likely Cause	Remediation
Every request fails immediately	Missing or mistyped token	Print token length and first/last characters to verify
Works locally, fails in production	Environment variable missing in deployment	Check container/CI secret injection
Stocks succeed, Forex fails	Endpoint prefix mismatch	Use quote-b-api for FX/metals and quote-stock-b-api for equities
Succeeds initially, then fails	QPS or quota limit exceeded	Throttle request rate and add exponential backoff
Multi-worker spikes fail together	Multiple processes sharing one token	Centralize scheduling or cache shared responses

Exponential Backoff Retry Pattern

pythonpython

1import os, random, time
2import requests
3
4def get_with_backoff(url: str, params: dict, retries: int = 5) -> dict:
5    delay = 1.0
6    for attempt in range(retries):
7        resp = requests.get(url, params=params, timeout=10)
8        body = resp.json() if resp.content else {}
9        if resp.status_code == 401 or body.get("ret") == 401:
10            raise RuntimeError(f"Auth failed (ret=401): {body.get('msg', 'token invalid')}")
11        if resp.ok and body.get("ret") == 200:
12            return body
13        if attempt == retries - 1:
14            raise RuntimeError(f"Retries exhausted: status={resp.status_code} body={body}")
15        time.sleep(delay + random.uniform(0, 0.5))
16        delay = min(delay * 2, 30)
17    return {}
18
19if __name__ == "__main__":
20    url = "https://quote.alltick.co/quote-stock-b-api/trade-tick"
21    params = {
22        "token": os.getenv("ALLTICK_API_TOKEN", "YOUR_API_TOKEN"),
23        "query": '{"trace":"backoff-test","data":{"symbol_list":[{"code":"700.HK"}]}}',
24    }
25    print(get_with_backoff(url, params))

How to Reduce Request Volume

Batch multiple tickers into a single symbol_list request instead of polling one symbol per HTTP call.
Migrate real-time price monitoring from high-frequency REST polling to WebSocket streaming.
Cache responses briefly in Redis or memory when multiple downstream services read the same symbols.
Funnel outbound API requests through a central rate limiter when running multiple worker processes.

Sources & Verification · 2026-10-13

Relevant endpoint, field, and exchange rules were checked against the primary specifications linked below.

Python examples passed ast.parse on Python 3.14.0. This checks syntax only; dependencies, runtime compatibility, and network responses were not tested.

Authenticated AllTick requests and production end-to-end tests were not run for this review. Record your token plan, library versions, market session, ret/trace, and observed results when reproducing these checks.

Primary specifications

Reproduce before deployment

Test missing, revoked, and wrong-scope tokens; inspect HTTP status and JSON ret/msg independently. Permission and quota errors do not necessarily use HTTP 401/429.
Coordinate limits across token-sharing workers, use bounded jittered backoff, and stop permanent authentication retries. Retain a redacted trace and timestamp.