Rate limits & quotas
Published, not hidden. These are the exact limits enforced by the gateway and nginx — if you hit one, the error JSON includes a Retry-After.
| Area | Limit | Notes |
|---|---|---|
| Signups | 3 accounts / IP / 24h | Anti-abuse; verified by proof-of-work, no email needed. |
| Sign-in | burst 10 / IP / 10 min | Failed attempts only; successes don't count. |
| Key rotate | 10 / account / min | Each rotate signs out every other device. |
| Key reveal | 30 / account / min | Responses are never cached. |
| Chat (web) | 120 messages / account / min | Streaming included. |
| Web chat storage | 300 conversations · 2,000 messages each · 32 KB / message | Oversized messages are rejected, never truncated. |
| API requests | per-IP + global ceiling | Generous; designed to stop floods, not builders. |
| Deposits | $5 – $5,000 per invoice | Crypto via 2328.io, credited 1:1, webhook + poll reconciliation. |
| Deposit status polling | 120 / account / min | Live provider lookups are throttled; stored status always available. |
| Admin login | 5 / IP / 15 min · 10 / min global | TOTP + username, single-use codes. |
| Request body | 2 MB | Applies to /api and /v1; window your history for long chats. |
| Upstream connect timeout | 30 s to first byte | No cap on streamed body — long generations are never killed mid-stream. |
Need a higher ceiling for a legitimate workload? Message support on Telegram with your account's last four digits and expected volume — limits are raised for real builders, not sold as a tier.