Limits & errors
Every error is JSON with a stable code;
limits exist per IP, per request, and per plan.
Error shape
{ "error": { "code": "rate_limited", "message": "…" } }| Status | Code | Meaning |
|---|---|---|
| 400 | invalid_request | Malformed query, body, or parameter. |
| 401 | unauthorized / invalid_credentials / invalid_grant | Missing or bad token; wrong project; used refresh token. |
| 403 | forbidden | Row-Level Security or role denied the operation. |
| 404 | not_found | Unknown table, object, or project. |
| 409 | conflict / email_taken | Unique/foreign-key violation; bucket not empty. |
| 413 | too_large | Upload over 50 MiB; realtime payload over 64 KiB. |
| 422 | quota_exceeded | Plan storage quota would be exceeded. |
| 429 | rate_limited / quota_exceeded / egress_exceeded | Per-IP rate limit; the project's request allowance; or its monthly egress allowance (on reads/downloads). |
| 504 | timeout / store_timeout | Statement hit the 10-second timeout; or the storage backend did not accept an object in time. Both are safe to retry. |
| 507 | db_quota_exceeded | The project's database is over its size limit: inserts and updates are refused (RPC, GraphQL and Edge Functions run read-only) until it is back under it. Reads, deletes and sign-in keep working. |
Per-IP rate limits
| Operation | Limit / minute |
|---|---|
| Auth signup | 5 |
| Auth token (login/refresh) | 10 |
| Storage uploads | 60 |
| WebSocket connections | 60 |
| Public/anon REST requests | 300 |
| Realtime HTTP publishes | 600 |
Plan quotas
| Quota | Starter | Pro | Business | Enterprise |
|---|---|---|---|---|
| Projects per organization | 2 | 20 | 100 | Custom |
| Data API requests / day | 50,000 | 1,000,000 | 5,000,000 | Custom |
| Storage per project | 100 MiB | 10 GiB | 100 GiB | Custom |
| Database size per project | 500 MiB | 8 GiB | 50 GiB | 200 GiB |
| Realtime connections per project | 50 | 500 | 2,000 | Custom |
| Egress per month | 5 GiB | 250 GiB | 2 TiB | Custom |
| KV keys per project | 10,000 | 1,000,000 | 10,000,000 | Custom |
| KV storage per project | 10 MiB | 256 MiB | 2 GiB | Custom |
The daily request count is an anti-abuse ceiling; each plan also has a
monthly request and egress allowance. Egress
is the volume of response bytes sent to clients: REST reads and storage
downloads, including public-bucket images. Once the monthly egress allowance
is spent, reads and downloads are refused with 429 egress_exceeded
while writes are never blocked; the dashboard warns at 80%.
Paid plans can add prepaid request packs, and each pack lifts
both the request and the egress allowance; buying one restores
service immediately.
Database size is measured every 15 minutes. Above the
limit, the Data API refuses inserts and updates with
507 db_quota_exceeded and runs RPC, GraphQL and Edge Functions
read-only, while reads, deletes, sign-in, storage and direct SQL connections
keep working. Owners and admins are e-mailed at 80% and when the limit is
passed. PostgreSQL does not shrink its files when rows are deleted: to get
back under the limit, delete data and run VACUUM FULL on the
affected tables from the SQL editor.
Plans scale from Starter to Enterprise; contact sales to get set up with the right fit for your workload. Daily request counts reset at midnight UTC.
Request limits
| Limit | Value |
|---|---|
| Rows per REST response | 1000 (limit parameter) |
| SQL statement timeout | 10 seconds |
| Storage object size | 50 MiB |
| Realtime message size | 64 KiB |
| KV value size | 256 KiB |
| KV key length | 512 bytes |