- Per-action rate limits, short-window throttles on burst behavior. Backed by
credit_usage. Source:packages/core/src/rate-limit.ts. - Plan quotas, monthly credit pools and feature gates. Source:
packages/shared/src/plans.ts. - Per-tier API call ceilings, Business and Enterprise only. Free and Pro do not include programmatic API access.
Per-action rate limits
| Action | Limit | Window | Endpoint |
|---|---|---|---|
score | 5 requests | 60 seconds | POST /api/score, POST /api/score/quick, POST /api/score/product |
chat | 30 requests | 60 seconds | POST /api/chat |
userId against a 60-second sliding window. The limit returns 429 Too Many Requests with a Retry-After header that matches the window.
If the rate-limit infrastructure cannot reach the database, the gate fails closed. The request is denied with Retry-After: 60 rather than allowed through. This is intentional: silent rate-limit bypass is a worse failure mode than a brief outage.
There is no global per-action rate limit on api (API key calls). API key calls are tracked but enforced through the per-tier monthly ceiling below.
Plan quotas
| Plan | Monthly credits | Scores (10 credits each) | Chat messages (1 credit each) | API calls/mo | Products | Seats |
|---|---|---|---|---|---|---|
| Free | 80 | 3 | 30 | 0 | 1 | 1 |
| Pro | 1,000 | up to 100 | up to 1,000 | 0 | 5 | 3 |
| Business | 2,000 | up to 200 | up to 2,000 | 25,000 | 25 | 10 |
| Enterprise | Unlimited | Unlimited | Unlimited | 100,000 | Unlimited | Custom |
Settings > API Keys. The credit pool resets at the start of each billing cycle. Score packs (one-time top-ups) carry over.
Quota numerics live in packages/shared/src/plans.ts. If the table above drifts from the source file, the source file wins. Open an issue.
Check live consumption with Get Usage and Quota:
Anonymous scoring
POST /api/score (without a session) and POST /api/score/quick accept anonymous reads but cap them tightly.
- 1 anonymous read per IP per hour.
- Result is held until a sign-up links it via
POST /api/score/link. - No history, no portfolio, no DAC chat.
429 response shape
Per-action and per-IP rate limits both return the same shape:402 Payment Required with code: "CREDIT_EXHAUSTED" or code: "PLAN_LIMIT_REACHED". Those are not retryable. See Errors for the full catalog.
Exponential backoff
The reference pattern below handles per-action 429s. Plan-quota errors should not be retried.Score packs
Add scoring capacity to any paid plan without upgrading the tier.| Pack | Scores | Price |
|---|---|---|
| Small | 20 | $29 |
| Medium | 50 | $49 |
| Large | 150 | $99 |
Upgrading
Upgrade fromSettings > Billing in the dashboard, or programmatically via Create Checkout Session. Enterprise customers can negotiate custom limits and SLAs.