Rate Limits & Security

Per-key limits

Rate limits and daily credit caps are configured per API key — not per plan. Set them when generating a key in Settings → API Keys.

Limit	Default	Configurable range	Description
Rate limit	100/min	10 – 1,000	Requests per minute for this key
Daily credit limit	100/day	10 – 10,000	Max AI credits consumed per day via this key

Rate limit response headers

Every authenticated response includes the current per-key request budget:

Header	Meaning
X-RateLimit-Limit	Requests allowed per minute for this key
X-RateLimit-Remaining	Requests left in the current window
X-RateLimit-Reset	Unix epoch (seconds) when the window resets

Send-specific limits (429)

Direct sends and approvals (POST /v1/replies/:id/send at autonomy level 2+, POST /v1/replies/:id/approve) have two extra guards on top of the request rate limit. Both return 429 with a Retry-After header:

Code	Limit	Retry-After
send_rate_limit_exceeded	Max 5 sends per API key per minute	60 seconds
lead_recently_contacted	Per-lead cooldown: the same lead cannot be contacted again within 15 minutes	900 seconds

Blocked sends are logged in the Decision Trail, so a rate-limited attempt is visible to the organization.

Additional limits

Limit	Details
IP rate limit	120 requests/min per IP — applies to all requests including unauthenticated ones. Error: ip_rate_limit_exceeded
Request body	Maximum 50KB. Larger payloads rejected with payload_too_large (413)
Timeout	30 second hard limit per request. Long-running AI calls return ai_error if exceeded