- Per-action rate limits, short-window throttles on burst behavior. Source:
packages/core/src/rate-limit.ts. - Plan quotas, monthly credit pools and feature gates. Source:
packages/shared/src/plans.ts. - Per-tier API call ceilings, Business and Enterprise only.
Per-action rate limits
The limit returns
429 Too Many Requests with a Retry-After header. Hits are tracked per userId against a 60-second sliding window. The gate fails closed if the database is unreachable.
There is no per-action rate limit on api (API key calls). They are tracked but enforced through the per-tier monthly ceiling.
Plan quotas
Free and Pro do not include programmatic API access. Mint API keys on Business or Enterprise from
Settings > API Keys.
Numerics live in packages/shared/src/plans.ts. The source file is authoritative.
Check live consumption with Get Usage and Quota.
429 response shape
402 with code: "CREDIT_EXHAUSTED" or code: "PLAN_LIMIT_REACHED". Those are not retryable. See Errors.
Exponential backoff
Anonymous scoring
POST /api/score (no session) and POST /api/score/quick accept anonymous reads at 1 per IP per hour. The result is held until a sign-up links it via POST /api/score/link.