Docs

Limits

The attempt limits, token lifetimes and size limits you can run into, in one place.

Attempt limits

These stop passwords, codes and vault keys from being guessed. Only failures count, and a success clears the counter, so ordinary use never reaches them. A request over the limit gets 429 with a Retry-After header. Why they work this way is explained in authentication.

AttemptLimitCounted per
Password sign-in10 failures per 15 minutesAccount and source address
Authenticator (TOTP) code5 failures per 15 minutesAccount and source address
Custom vault key (web, CLI, MCP and API)10 failures per 15 minutesUser or service token, and source address
Email OTP code5 failures, then the code is destroyedIssued code
Sending an email OTP codeOne every 60 secondsEmail address
CLI connection requests (apivault login)5 per 10 minutesSource address

Token lifetimes

CredentialLifetimeAfterwards
CLI device token90 daysRun apivault login again
Service token7, 30, 90, 180 or 365 daysCreate a new one
MCP access token1 hourRefreshed automatically by your client
MCP refresh token30 daysApprove the connection again
MCP authorization code5 minutesStart the connection again
Email OTP code10 minutesRequest a new code

Service token expiry

Service tokens default to 90 days and have no never-expires option, so a forgotten pipeline credential cannot outlive the pipeline. See expiry.

Request limits

RequestLimit
Audit log entries per request50 by default, 1000 at most

Integration limits

These are set by the platform you sync to. Details, including what happens to keys that don't fit, are on each integration's page.

PlatformLimit
Supabase100 secrets per project, not counting its built-in SUPABASE_ secrets
Cloudflare WorkersValues up to 5 KiB; the number of variables depends on your Cloudflare plan
GitHub ActionsEnvironment names up to 255 characters, without " < > \ / : * ? |