Limits
What your plan holds, your workspace's fair-use limits, and the API's rate limits.
A workspace has three kinds of limit:
- Your plan: devices a month, members and, on Hobby, passes. The Usage card on the Tools page shows them.
- Fair use: far above what a workspace uses. They keep the services every workspace shares up when a script or a loop runs away. The Usage card shows eight of them, each once 80% of it is spent: tools, sign-in mail, additions, lookups, list rows, webhook events, notifications and licence emails.
- Rate limits: the API's, per key and per workspace. Toolaby's other endpoints are set to what a person does, not what a script does.
Configure → Plan shows the same, with the fee. The settings of your tools' own plans have ranges too, at the end of this page.
If a limit is in your way, write to hello@toolaby.app. Enterprise raises any of them for one workspace.
Your plan
| Hobby | Pro | |
|---|---|---|
| Devices a month, counted across the workspace's tools: each copy of an extension in a browser, and each signed-in user of a web app | 2,500 | 50,000 |
| Members, counting invitations not yet answered | 3 | 10 |
| Passes live at once: grants, CSV rows, free checkouts | 100 | no limit |
Plans covers the fee, what each plan includes and what counts as a pass.
On Test, whatever the plan, a workspace holds 100 people: the addresses with an account there or a licence of your tools. Past 100, a new address is refused, with the reason, and everyone already there keeps their access. The Usage card shows it as People on Test. See Test and Live.
Fair use
Most day limits count the 24 hours from their first use; once the Usage card shows one, its ⓘ says when it starts again. Grants per tool, workspace exports, moves and signing key rotations count the last 24 hours, or the last hour, at each request; rotations the last 30 days too.
Toolaby also keeps limits of its own across workspaces, so that the services they share stay up for everyone. A request one of them turns away says so.
| Each day or hour | Limit |
|---|---|
| Additions: grants, customers added by hand, CSV rows, sales imported, subscriptions moved | 20,000 a day per workspace, from the dashboard, the API, the command line and Import together |
| Grants | 1,000 a day per tool, however they are made; the API and the command line refuse past it. Bring more in with the tool's Import page |
| Customer lookups | 20,000 a day per workspace, all its keys together: Retrieve a customer and List grants together |
| Customer lists read | 300,000 rows a day per workspace, the dashboard's Customers page and the API's list together. A list reads its licences, subscriptions, grants, sign-ins and customers added, and the accounts and devices they name: some 8,000 rows for 2,000 customers, and it sets aside the most it could read before it reads |
| Sign-in links and address confirmations | Limited per address and per workspace, so that no form can flood an inbox. Signing in with Google sends no mail |
| Licence keys no payment sent: one resent, a free checkout's, a seat's from a free pass | 200 a day per workspace. On Test every licence key counts, a payment there being a test card: 50 a day per workspace |
| Notifications | 2,000 new sales, refunds, cancellations and disputes a day per workspace; a fact reported again counts once |
| Notification mails | 1,000 a day from one workspace (200 on Test) |
| Webhook events | 5,000 a day per workspace, examples among them; a fact reported again is sent and counted once. On a busy day Toolaby may hold events back: they are kept for up to 72 hours and sent, each workspace's oldest first, once there is room again. A kept event may reach your endpoint after newer events of the same workspace: its created is when it happened. Configure → Events says how many were held today and how many wait, and the workspace's owners get one email that day. An event no endpoint listens for is neither sent nor counted |
| Example webhook events | 100 a day per workspace, from Send a test event and npx -y toolaby@latest webhooks trigger together. An example is a new event, and one the day of events holds back is refused: not sent, not kept, and it counts nothing |
| Coupons made | 100 a day per workspace, from the dashboard and the command line together |
| Signing key rotations | 3 in 24 hours and 10 in 30 days per workspace, one at a time: while a new key is on its way to signing, Rotate key waits for it. Replace key now, an owner's, is never refused by these: it waits only ten minutes after the newest key |
| New workspaces | 10 a day per account. Copy to Live counts a workspace it makes the same way. One Toolaby could not make after all counts nothing |
| Stripe test accounts, on Test | 5 a day per account, from new workspaces and Make it together, one per workspace, and one Stripe would not make counts nothing |
| Invitations | 20 a day per workspace. A resent invitation counts again, and a revoked one still counts |
| Workspace exports | 3 a day |
| Moving subscriptions from another Stripe account | 3,000 requests an hour per workspace, reading and moving together; 20 keys checked an hour per workspace; 30 reports a day per workspace |
| Sizes | Limit |
|---|---|
| Workspaces per account | 5: an account in five workspaces cannot make another |
| Tools per workspace | 50, bundles among them |
| Plans per tool | 40, retired ones among them |
| Features per tool | 40 |
| API keys per workspace | 20 |
| Signing keys published for a tool | 12: the key that signs, one about to, and the newest of those that still verify. A key that no longer verifies, and is 30 days old, is deleted the next day |
| Webhook endpoints | 10 per workspace |
| Origins under Your own pages | 5 |
| Seats per team licence or team subscription | 100 |
| Rows per CSV file | 10,000 |
| Brand images | 512 KB each |
| Customers in a list | the newest 2,000 licences, subscriptions, grants, sign-ins and customers added per tool, in the dashboard and the API alike. A customer beyond them opens by their address |
An addition is counted before it is written, so one the database then refuses still counts. A CSV row or a sale already imported is skipped and counts nothing. Past the day's 20,000, the API and the command line answer 429, the dashboard says so, and an import leaves the rest of the file out with the reason: send it again the next day.
Past a day's customer lookups, Retrieve a customer answers 429. The customer list, and what webhooks tell you, still answer.
A sign-in link or address confirmation over its limit is not sent. Testing sign-in with many new addresses? Reuse an address that has signed in before, or sign in with Google, which sends no mail. An invitation over its limit is refused with 429; a resend over it is not sent. A resent key over the limit is refused, with the reason. Receipts, and the key a payment bought on Live, have no limit. A key over its day is not mailed until the day starts again: a resend or a seat says so, and a free checkout's key waits for a resend.
A notification over its limit is not mailed; the sale, refund or cancellation is on the dashboard as always. A subscription set to end, kept, and set to end again within one day (UTC) is one cancellation, its end moved or not: one mail and one subscription.cancelled event. Other changes to a subscription set to end send nothing.
Rate limits
| Limit | |
|---|---|
| API requests | 600 a minute per key and 1,200 per workspace, all its keys together, in the clock's minute (UTC); the customer list 30 pages a minute per workspace, all its keys together, up to 500 customers a page |
| The command line and its MCP server | 120 calls a minute from one account, in the clock's minute (UTC); listing tools and reading customers also 30 a minute from one account. Past either, 429 with Retry-After |
Toolaby's other endpoints are limited too, and answer 429: a tool's uses and free uses, signing an extension in, a new key's confirmation, licence activation, seats, sign-in, key resend, checkout, the docs over MCP, and a signed-in buyer's own requests (what they hold, their devices, their seats and the billing portal). None is shared by all the buyers of a tool. A seat over its limit is refused, with the reason.
Your tools' plans
What you set on a plan under Pricing has a range:
| Range | |
|---|---|
| Devices | 1 to 10 per plan; a subscription plan may leave it open |
| Devices signed in, where nothing sets a limit | 20 per account and tool: on the tool's Free plan, a trial, a grant, or a plan that leaves devices open. The 21st signs the oldest out |
| Free-plan uses per device or account | up to 1,000, in total or each week or month; up to 200 each day |
| Free trial | up to 365 days, on each subscription plan |