Rate limits

Every counter resets on a fixed one-minute window.

IP ceiling

We count it before authentication, so a flood of invalid tokens is turned away before any credential check.

It caps abuse, not your use, and sits well above one pipeline, a CI egress range or a NAT with many identities. The exchange routes under /api/v1/auth have no identity yet, so only this ceiling applies to them.

Identity ceiling

The pricing page shows the same numbers. Change your plan: billing and plans.

We key the counter on the identity, not the credential, so rotating your credential does not reset it. Two identities in one project count separately.

A bulk read that overshoots leaves the bucket over its ceiling until the minute ends; the next minute starts at zero.

Workspace ceiling

Free only. Every identity and every person's CLI in the workspace draws on it, at the same cost as the identity ceiling. We check your identity first, so a request the workspace ceiling refuses still counts against your identity's minute.

Machine identities are free and unlimited (billing), so without this ceiling more identities would mean more Free throughput. The refusal is the same 429: retry-after gives the wait.

429 response

HTTP/1.1 429 Too Many Requests
retry-after: 17

{ "error": "rate_limited" }

retry-after is whole seconds until the window resets, never below 1. We return the same body for every ceiling, because naming the ceiling would reveal more about other tenants than about you.

POST /api/v1/dynamic/{address}/lease has a separate 429, ceiling_reached, when your environment trips our abuse ceiling on minting credentials. Codes: error codes.

Back-off

const res = await fetch(url, { headers: { authorization: `Bearer ${credential}` } });
if (res.status === 429) {
  const wait = Number(res.headers.get("retry-after") ?? 1) * 1000;
  await new Promise((done) => setTimeout(done, wait));
}

Sleep for retry-after seconds, then retry. Without the header, wait one second and double on each further 429, up to a minute.

Next: versioning.