# Limits > What your plan holds, your workspace's fair-use limits, and the API's rate limits. A workspace has three kinds of limit: * **Your plan**: devices a month, members and, on Hobby, passes. The **Usage** card on the **Tools** page shows them. * **Fair use**: far above what a workspace uses. They keep the services every workspace shares up when a script or a loop runs away. The **Usage** card shows eight of them, each once 80% of it is spent: tools, sign-in mail, additions, lookups, list rows, webhook events, notifications and licence emails. * **Rate limits**: the API's, per key and per workspace. Toolaby's other endpoints are set to what a person does, not what a script does. **Configure → Plan** shows the same, with the fee. The settings of your tools' own plans have ranges too, at the end of this page. If a limit is in your way, write to [hello@toolaby.app](mailto:hello@toolaby.app). [Enterprise](https://toolaby.app/docs/plans.md#enterprise) raises any of them for one workspace. ## Your plan | | Hobby | Pro | | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | -------- | | Devices a month, counted across the workspace's tools: each copy of an extension in a browser, and each signed-in user of a [web app](https://toolaby.app/docs/analytics.md#web-apps) | 2,500 | 50,000 | | Members, counting invitations not yet answered | 3 | 10 | | Passes live at once: grants, CSV rows, free checkouts | 100 | no limit | [Plans](https://toolaby.app/docs/plans.md) covers the fee, what each plan includes and what counts as a pass. On Test, whatever the plan, a workspace holds 100 people: the addresses with an account there or a licence of your tools. Past 100, a new address is refused, with the reason, and everyone already there keeps their access. The **Usage** card shows it as *People on Test*. See [Test and Live](https://toolaby.app/docs/test-and-live.md). ## Fair use Most day limits count the 24 hours from their first use; once the **Usage** card shows one, its ⓘ says when it starts again. Grants per tool, workspace exports, moves and signing key rotations count the last 24 hours, or the last hour, at each request; rotations the last 30 days too. Toolaby also keeps limits of its own across workspaces, so that the services they share stay up for everyone. A request one of them turns away says so. | Each day or hour | Limit | | ----------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Additions: grants, customers added by hand, CSV rows, sales imported, subscriptions moved | 20,000 a day per workspace, from the dashboard, the API, the command line and **Import** together | | Grants | 1,000 a day per tool, however they are made; the API and the command line refuse past it. Bring more in with the tool's **Import** page | | Customer lookups | 20,000 a day per workspace, all its keys together: **Retrieve a customer** and **List grants** together | | Customer lists read | 300,000 rows a day per workspace, the dashboard's **Customers** page and the API's list together. A list reads its licences, subscriptions, grants, sign-ins and customers added, and the accounts and devices they name: some 8,000 rows for 2,000 customers, and it sets aside the most it could read before it reads | | Sign-in links and address confirmations | Limited per address and per workspace, so that no form can flood an inbox. Signing in with Google sends no mail | | Licence keys no payment sent: one resent, a free checkout's, a seat's from a free pass | 200 a day per workspace. On Test every licence key counts, a payment there being a test card: 50 a day per workspace | | Notifications | 2,000 new sales, refunds, cancellations and disputes a day per workspace; a fact reported again counts once | | Notification mails | 1,000 a day from one workspace (200 on Test) | | Webhook events | 5,000 a day per workspace, examples among them; a fact reported again is sent and counted once. On a busy day Toolaby may hold events back: they are kept for up to 72 hours and sent, each workspace's oldest first, once there is room again. A kept event may reach your endpoint after newer events of the same workspace: its `created` is when it happened. **Configure → Events** says how many were held today and how many wait, and the workspace's owners get one email that day. An event no endpoint listens for is neither sent nor counted | | Example webhook events | 100 a day per workspace, from **Send a test event** and `npx -y toolaby@latest webhooks trigger` together. An example is a new event, and one the day of events holds back is refused: not sent, not kept, and it counts nothing | | Coupons made | 100 a day per workspace, from the dashboard and the command line together | | Signing key rotations | 3 in 24 hours and 10 in 30 days per workspace, one at a time: while a new key is on its way to signing, **Rotate key** waits for it. **Replace key now**, an owner's, is never refused by these: it waits only ten minutes after the newest key | | New workspaces | 10 a day per account. **Copy to Live** counts a workspace it makes the same way. One Toolaby could not make after all counts nothing | | Stripe test accounts, on Test | 5 a day per account, from new workspaces and **Make it** together, one per workspace, and one Stripe would not make counts nothing | | Invitations | 20 a day per workspace. A resent invitation counts again, and a revoked one still counts | | Workspace exports | 3 a day | | Moving subscriptions from another Stripe account | 3,000 requests an hour per workspace, reading and moving together; 20 keys checked an hour per workspace; 30 reports a day per workspace | | Sizes | Limit | | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Workspaces per account | 5: an account in five workspaces cannot make another | | Tools per workspace | 50, bundles among them | | Plans per tool | 40, retired ones among them | | Features per tool | 40 | | API keys per workspace | 20 | | Signing keys published for a tool | 12: the key that signs, one about to, and the newest of those that still verify. A key that no longer verifies, and is 30 days old, is deleted the next day | | Webhook endpoints | 10 per workspace | | Origins under *Your own pages* | 5 | | Seats per team licence or team subscription | 100 | | Rows per CSV file | 10,000 | | Brand images | 512 KB each | | Customers in a list | the newest 2,000 licences, subscriptions, grants, sign-ins and customers added per tool, in the dashboard and the API alike. A customer beyond them opens by their address | An addition is counted before it is written, so one the database then refuses still counts. A CSV row or a sale already imported is skipped and counts nothing. Past the day's 20,000, the API and the command line answer `429`, the dashboard says so, and an import leaves the rest of the file out with the reason: send it again the next day. Past a day's customer lookups, **Retrieve a customer** answers `429`. The customer list, and what webhooks tell you, still answer. A sign-in link or address confirmation over its limit is not sent. Testing sign-in with many new addresses? Reuse an address that has signed in before, or sign in with Google, which sends no mail. An invitation over its limit is refused with `429`; a resend over it is not sent. A resent key over the limit is refused, with the reason. Receipts, and the key a payment bought on Live, have no limit. A key over its day is not mailed until the day starts again: a resend or a seat says so, and a free checkout's key waits for a resend. A notification over its limit is not mailed; the sale, refund or cancellation is on the dashboard as always. A subscription set to end, kept, and set to end again within one day (UTC) is one cancellation, its end moved or not: one mail and one `subscription.cancelled` event. Other changes to a subscription set to end send nothing. ## Rate limits | | Limit | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | API requests | 600 a minute per key and 1,200 per workspace, all its keys together, in the clock's minute (UTC); the customer list 30 pages a minute per workspace, all its keys together, up to 500 customers a page | | The command line and its MCP server | 120 calls a minute from one account, in the clock's minute (UTC); listing tools and reading customers also 30 a minute from one account. Past either, `429` with `Retry-After` | Toolaby's other endpoints are limited too, and answer `429`: a tool's uses and free uses, signing an extension in, a new key's confirmation, licence activation, seats, sign-in, key resend, checkout, the docs over MCP, and a signed-in buyer's own requests (what they hold, their devices, their seats and the billing portal). None is shared by all the buyers of a tool. A seat over its limit is refused, with the reason. ## Your tools' plans What you set on a plan under **Pricing** has a range: | | Range | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Devices | 1 to 10 per plan; a subscription plan may leave it open | | Devices signed in, where nothing sets a limit | 20 per account and tool: on the tool's Free plan, a trial, a grant, or a plan that leaves devices open. The 21st signs the oldest out | | Free-plan uses per device or account | up to 1,000, in total or each week or month; up to 200 each day | | Free trial | up to 365 days, on each subscription plan |