# Limits and quotas

Limits cap how much a credential can call through a gateway environment. They are set for the environment in the gateway's **Policies** tab, and a key or user can set lower values on its own page.

## Usage

An environment's limits apply to every key and user of that environment. Each credential is counted on its own: a limit of 600 requests per minute means 600 for each key, not 600 for all of them. A field left empty uses the default in the tables on this page.

A key or user can only set a value lower than its environment's. The portal refuses a higher value when you save. For a gateway user, the limits are shared by all of that user's sessions.

Each environment has its own limits. A new environment starts with a copy of the limits of the one it was created from.

## Rate limit

| Field | Default | Description |
| --- | --- | --- |
| **Requests / minute** | 600 | Sustained rate per credential. |
| **Burst** | 100 | How many calls can arrive at once before the rate applies. |

A call over the rate is refused with `rate_limit` and a `Retry-After` header.

## Environment-wide rate limit

| Field | Default | Description |
| --- | --- | --- |
| **Requests / minute, all credentials** | None | One count shared by every key and user of the environment. It is the most your API receives in total. |

This limit exists only on the environment. A call over it is refused with `rate_limit` and a `Retry-After` header.

## Quota

| Field | Default | Description |
| --- | --- | --- |
| **Calls / hour** | 10,000 | Calls per credential in a clock hour. |
| **Calls / day** | 50,000 | Calls per credential in a day. The day starts at 00:00 UTC. |

A call over a quota is refused with `quota`. `Retry-After` is the number of seconds until the hour or the day ends. A refused call does not count toward the quota.

## Concurrency

| Field | Default | Description |
| --- | --- | --- |
| **Max concurrent calls** | 8 | Calls in flight per credential at one moment. |

A call over the limit is refused with `concurrency` and `Retry-After: 1`.

## Request limits

| Field | Default | Description |
| --- | --- | --- |
| **Max body (KB)** | 1024 | Size of a REST body or of the arguments of an MCP call. |
| **run_code max seconds** | 30 | Run time of one Code mode script. |
| **run_code memory (MB)** | 128 | Memory of one script. |
| **run_code max ops** | 200 | Operation calls one script can make. |

The three `run_code` defaults are also the maximum. A body over the limit is refused with `body_too_large`.

## Channels

| Field | Default | Description |
| --- | --- | --- |
| **MCP** | On | Whether the MCP endpoint can be used. |
| **REST** | On | Whether the REST mirror can be used. |

A call on a channel that is off is refused with `channel`. A credential can use only the channels its environment serves.

## Validity

These two fields exist only on a key or a user.

| Field | Default | Description |
| --- | --- | --- |
| **Not before** | Valid immediately | The credential is refused until this date. |
| **Expires** | Never | The credential is refused after this date. A user can no longer sign in, and their sessions stop working. |

## Errors

Over REST, a refused call returns the status in this table and a body with the code. Over MCP, the tool call fails with the text `Denied (<code>): <message>`.

| Code | HTTP status | `Retry-After` | Cause |
| --- | --- | --- | --- |
| `rate_limit` | 429 | Yes | The credential's rate or the environment-wide rate was exceeded. |
| `quota` | 429 | Yes | The hourly or daily quota is used up. |
| `concurrency` | 429 | Yes | Too many calls in flight. |
| `runner_busy` | 429 | Yes | The script could not start because the code runner is at capacity. |
| `body_too_large` | 413 | No | The body or the arguments exceed **Max body (KB)**. |
| `channel` | 403 | No | The credential or the environment does not allow this channel. |

A credential outside its validity window gets `401`, with `Denied (not_yet_valid)` or `Denied (expired)` in the message.

Every refusal is a request in the gateway's **Logs** tab with its reason. The **Overview** tab shows the number of denied requests in the last 24 hours and the most frequent reason.

## Other limits

| Limit | Value |
| --- | --- |
| Failed authentications from one IP address | 30 per minute. Further requests from that address get `429` with the code `auth_throttled` until the minute ends. |
| Failed sign-ins of a gateway user | 5. The user is locked for 15 minutes. |
| Result of a Code mode script | 1 MB |
| Time a connection has to answer under fan-out routing | 20 seconds |
| Window for repeated writes | 1 to 86,400 seconds. The default is 60. |
| Variables per environment | 100 |

## Next steps

- [Restrict access by IP address](https://docs.faustine.ai/agent-gateway/ip-restrictions/): the allowlist, the blocklist and blocked countries.
- [Gateway HTTP](https://docs.faustine.ai/reference/gateway-http/): the error envelope and every error code.
- [Limits](https://docs.faustine.ai/reference/limits/): the limits of the rest of the platform.