SDK · @manybases/js

@manybases/js — limits

Measured, not guessed.

• 300 requests per minute, per key. A publishable key is shared by every visitor of your app, so the bucket is common: roughly 100 visits a minute at 3 calls per visit. Beyond, 429 rate_limited with retryAfter: 60 — the period, not a remainder.
• The magic link: 20 requests per hour per IP, 5 per hour per address, 50 sign-in emails per UTC day per app — 70 across all apps. Beyond 5 for one address the answer stays { sent: true } and nothing is sent; beyond the others, 429 rate_limited with retryAfter — what remains of the hour or of the UTC day, rounded up to the minute.
• One preflight per (origin, exact URL). Cross-origin requests carrying Authorization are always preflighted; browsers cache the answer for at most two hours. A paginated list pays one preflight per page.
• No automatic retry, ever. For a visitor with no session, the idempotency store runs in de-duplicate-only mode: replaying a POST with the same key returns 409 and never the first response, so a retry would turn a successful form submission into a conflict. insert(…, { idempotencyKey }) is opt-in.
• Uploads need a known length. Pass a Blob, File, ArrayBuffer or Uint8Array; streams are refused before the call. The 25 MB cap is enforced by the API.
• Sessions live in localStorage by default, for 30 rolling days. Any injected script can read them: your Content Security Policy protects your session, the SDK cannot. Pass storage to change where they live, or storage: null to keep them in memory only.
• On the server, build one client per request. A module-level client shares its session between concurrent requests.
• Rows, batches and payloads follow the API's limits: 64 KB per row (32 KB on a form table), 100 rows per insert (10 on a form table), 256 KB per request, 200 rows per page. The full table is in Limits and quotas.
• Out of this version: DELETE /v1/auth/me and the spaces routes. They are additions to come, not breaking changes.