Rate limits on public pages
Some pages work without a sign-in: the links in your email, the gift card page, and the checks that guard an application. Anyone on the internet can call them, so the platform limits how fast one source can get them wrong.
Three rules hold for every limit on this page:
- The platform counts failures, not visits. A right link, a right credential, or a valid pass costs nothing. Reloading a share link never uses up your budget.
- The platform counts per source address. Someone else's wrong guesses don't slow you down.
- The limit is a sliding window. When it passes, the budget returns by itself.
What you see
A source over its limit gets a 429 Too Many Requests answer, with a message that says
too many bad links came from your address. Wait a few minutes and try again. Retrying
sooner only keeps the window full.
An access gate answers 401 instead, since the visitor's browser or tool needs
that status.
The limits
| What | What counts as a failure | Limit |
|---|---|---|
| Links with a token in them: sign-in links, email confirmation links, failure share links, operator action links, and gift card links | A token that matches nothing | 20 in 5 minutes |
| An access gate credential, in Basic or token mode | A wrong username, password, or token | 10 in 5 minutes |
| The gate pass that the platform gives a visitor | A pass or ticket with a bad signature. No pass costs nothing | 60 in 5 minutes |
| The gate check for an application that doesn't exist | An unknown application | 30 in 5 minutes |
| Typing a gift card code by hand | Each lookup | 10 in 15 minutes |
| Redeeming gift cards from one account | Each try | 10 in 15 minutes |
The platform health check at /health |
Every call | 120 in 1 minute |
| Payment and chat webhooks | A bad signature or secret. A correctly signed event never meets the limit | 30 in 5 minutes |
Sign-in, sign-up, the two-factor code, and the API each have their own limits too. The sign-in limit is 5 wrong tries in 15 minutes. The two-factor code limit is also 5 in 15 minutes. The platform limits failed API token checks per source and per token.
If you hit a limit by mistake
A shared office or a Virtual Private Network (VPN) can put many people on one source address.
If a right link or code gets a 429 answer, wait for the window to pass. If it keeps happening on a shared
address, ask support.