Guides · Concepts
Limits and quotas
Every bound the API enforces, with its unit, what it answers, and how it is released. Nothing is bounded outside this page.
Sizes and rates#
| Limit | Value | Answer |
|---|---|---|
| Request payload | 256 KB | 413 |
| File size | 25 MB — declared length, checked before the first byte | 413 |
| Row size | 64 KB (32 KB on a form table), platform columns included, on create and update | 413 |
| Batch creation | 100 rows (10 on a form table) | 413 |
| Rows per page | limit at most 200, default 50 | 400 beyond |
| Request duration | 10 s | 408 timeout |
| Rate per key | 300 requests per minute — a publishable key is shared by every visitor of the app | 429, Retry-After: 60 |
| Form table | 10 creations per minute per IP; 10 000 rows per table | 429; 402 |
| Magic link | 20 requests per hour per IP address (an IPv6 address counts by its /64); 5 per hour per email address — beyond, the answer stays the same and nothing is sent | 429; the same 200 |
| Magic-link emails per day | 50 per app and 70 across all apps, until 00:00 UTC | 429 |
| Management calls to the platform | 300 reserved per 5 minutes per account, and 150 more for a request carrying an owner session; 600 across all accounts | 429, Retry-After: 300 |
| Applying a shared secret | 60 reserved per 5 minutes per account; 200 across all accounts | 429, Retry-After: 300 |
| Users per app (seats) | 3 on Free, 1 000 on Builder and Studio — taken at sign-up | 402 at that sign-up; signing in is never refused |
| Function module | 1 MB | 413 |
| Function per invocation | 10 000 ms of CPU at most, which is also the default; 100 subrequests by default | 400 at deployment above 10 000 ms of CPU; 503 during execution |
| Calls to a function | 60 a minute and 300 a UTC day from one address (an IPv6 address counts by its /64); 3,000 a UTC day for the whole function — defaults, which rate_limit changes per function, up to 6,000 a minute and 1,000,000 a day | 429, Retry-After |
| Secret value | 5 KB | 413 |
| Variables on a function | 126 — its vars, the project's secrets and the account's shared secrets together, on top of the two Manybases injects | 413 |
| Secret names on a project | 126 — its own, the account's, and removals still in progress; replacing a value is never refused | 413 |
| Note on a shared secret | 200 characters, and a note that contains the value is refused | 400 |
| Site | 500 files · 5 MiB per file · 10 MiB per site · 12 MiB on the wire | 413 |
Site through the deploy_site tool | 30 files, 100 KB in total | refused by the tool |
| Private file URL | valid 1 hour by default; a public URL has no expiry | — |
| Re-authentication window | 5 minutes, for DELETE /v1/auth/me | 401 |
| Remote connector OAuth gates | 30 requests per 10 s on register and token, 10 per 10 s on authorize, per IP; body 32 KB | 429; 413 |
Sizes count bytes (UTF-8). The form-table limits apply to anonymous and signed-in callers; sk_ and ak_ are exempt from them. Every other line applies to every identity.
Plan quotas#
Quotas are counted on the account, across all projects.
| Free | Builder | Studio | |
|---|---|---|---|
| Apps (projects) | 2 | 20 | 100 |
| Users per app | 3 | 1 000 | 1 000 |
| File storage | 500 MiB | 10 240 MiB | 102 400 MiB |
| Database size | 100 MiB | 1 024 MiB | 5 120 MiB |
| Requests per UTC month | 1 000 000 | 5 000 000 | 10 000 000 |
Requests are the data-plane requests carrying a valid key; replays and authentication refusals are not counted. The figures are parameters of the plan, read at each check; changing one is never a deployment. Prices are on the pricing page.
What happens at a quota#
Nothing is deleted, and nothing you built is taken away. The account is never billed past its plan.
- The app limit refuses the creation of a new project (
402 quota_exceeded, with the figure and the two exits: delete a project, or upgrade). Deleting a project frees its slot immediately. - A volume quota — file storage, database size, requests of the month — puts every project of the account in read-only mode (
status: suspended): reads keep serving; every write on the data plane answers402 quota_exceededwith the figure. What "write" means here: creating, updating or deleting rows, changing presets, spaces, files and invitations; SQL that is not aSELECT; and creating a user (sign-up, or consuming an invitation or a magic link). Three things keep working: existing users signing in, the user-management gestures (delete a user, reset link), and the whole management plane — card, keys, export, and deleting a project, which is the way out. - Coming back to Free with more than 2 projects keeps them all; the ones beyond the limit, in creation order, switch to read-only until the account is back under.
Release: the request window reopens on the 1st of the month (UTC), and deleting projects never resets it. Storage and database size are released by making room, then having it noticed — the platform's reading refreshes on its own within minutes, and the status follows at the next hourly tick. Upgrading reopens creation immediately; the card and the data plane follow within an hour, plus at most 60 seconds for the cached verdict to expire.
Rate limits, precisely#
A 429 on a key carries Retry-After: 60 — the period, never a remainder. A replayed idempotent request consumes no counter. On the form preset, a refused creation does not count either.
On the magic link, Retry-After is what remains of the hour, or of the UTC day, rounded up to the minute. Beyond 5 requests an hour for one address, nothing is sent and the answer does not change: no one learns that someone else asked for links for that address. The daily lines bound the emails Manybases sends for every app from one sending account, which also carries the dashboard's sign-in codes. When the counter shared by all apps does not answer, three emails per app and per UTC day still go out, then the answer is 503.
The lines on management calls and on shared secrets bound what Manybases spends on its infrastructure provider, not what you consume — the provider meters us as one customer, so one account looping could refuse everyone else. They cover the management gestures that reach it: creating, deleting or exporting a project; deploying, rotating or destroying a function and listing its secret names; setting or removing a project secret; deploying or taking down a site; applying a shared secret. A gesture reserves what it may cost before it acts — all or nothing, at most 61 calls ahead — and gives back whatever it did not send.
Your account's share is 300 per 5 minutes. A request carrying a verified owner session draws on a separate share of 150, so an agent that emptied the first one never closes the dashboard: deleting a project, which is the way out of a quota, stays open. Across all accounts the share is 600, and a separate share is set aside for the work Manybases does on its own, so our own background work can never starve yours. When the common share is full, a refused account takes a dated rank and what frees up goes to it first, for up to 10 minutes — no maximum delay is promised.
Refused before acting, the answer is 429 rate_limited with Retry-After: 300 — the period, never a remainder: nothing ran, and the idempotency key stays free, so the same request can be replayed unchanged. A share that runs out mid-gesture answers 503 with the same delay; what was already done is kept. A refusal of this kind never hides a quota refusal (402) or a missing confirmation (428) — those are answered first.
On a function's host, only calls to a function that exists are counted, and only the calls it admits: a preflight, a refused call and an unknown name are not. Retry-After is what remains of the address's minute, or the time to 00:00 UTC rounded up to the minute. An address's minute opens with its first call, so up to twice the limit can pass across the boundary of two windows. Several people behind one address — an office, a school, a mobile network — share its limits, and so do the Workers that call a function. A function's daily limit bounds what its visitors can have billed; it does not stop someone who holds ten addresses from using up the day.