# Limits and quotas

URL: /code/api/limits · Id: `page:code/api/limits`

> Requests per second, page sizes, token lifetimes, webhook retries and cache sizes, each with the page that explains it.

Every platform throttle, size, timeout and retry schedule in one table per area. A throttle protects the platform and answers `429`; a [Limit](/business/nouns/limit) protects the business and waits on an [Approval](/business/nouns/approval) ([throttling](/code/api/guides/throttling)).

## Requests
| Throttle | Default |
| --- | --- |
| Requests per live key | 100 per second |
| Requests per test key | 25 per second |
| Requests per namespace, all keys together | 1,000 per second |
| `do` calls in flight per key | 50 |
| Requests per visitor on a publishable key | 10 per second |

A throttled call returns `429` with `Retry-After` and records nothing. To move a large batch, `send` it in batches of 100 and let the queue absorb the burst.

## Lists and writes
| What | Limit | Explained in |
| --- | --- | --- |
| Records per call, `limit` | 20 by default, 100 at most | [Pagination and filtering](/code/api/guides/pagination-and-filtering) |
| `meta.total` | Exact up to 10,000 matches, then an estimate | [Pagination and filtering](/code/api/guides/pagination-and-filtering) |
| Cursors | Never expire; bound to their query | [Pagination and filtering](/code/api/guides/pagination-and-filtering) |
| Idempotency key | Up to 255 characters, held forever | [Idempotency](/code/api/guides/idempotency) |
| Approval wait | 48 hours before it escalates, set by `approvalHours` | [`startup.ts`](/code/startup-ts#approval-hours) |

## Keys and sessions
| What | Lifetime | Explained in |
| --- | --- | --- |
| CI token from `login --oidc` | 15 minutes | [Keys](/code/api/guides/keys#machines-without-secrets) |
| A rolled key's predecessor | Until its `--expire-in`, such as `24h` | [Keys](/code/api/guides/keys) |
| A claimed [Task](/business/nouns/task) | A 15-minute lease, then back to the queue | [CLI](/code/cli) |

## Deliveries and streams
| What | Limit | Explained in |
| --- | --- | --- |
| Webhook acknowledgment | Any `2xx` within 10 seconds | [Webhooks](/code/api/guides/webhooks) |
| Webhook retries | 12 tries over three days: 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, then every 12 hours | [Webhooks](/code/api/guides/webhooks) |
| Signing secret rotation | Both signatures for 24 hours | [Webhooks](/code/api/guides/webhooks) |
| Stream heartbeat | A comment line every 15 seconds; reconnect after 45 silent seconds | [Realtime](/code/sdk/guides/realtime) |
| [Event](/business/nouns/event) retention | Forever, ordered by `seq` per namespace | [Event streams](/code/platform/event-streams) |

## Storage, cache and queues
| What | Limit | Explained in |
| --- | --- | --- |
| [Share](/business/nouns/share) link | Signed, and expires after 7 days by default | [Storage](/code/platform/storage) |
| Cache value | 1 MB at most; expires after one hour by default | [KV cache](/code/platform/kv-cache) |
| Queue retries | 5 attempts over 24 hours by default, each a new [Action](/business/nouns/action) | [Queues](/code/platform/queues) |
| Actions | Kept forever, so a replayed idempotency key returns its first Action a year later | [Idempotency](/code/api/guides/idempotency) |