Rate limits
BusinessMode applies protective rate limits to authenticated API requests. They bound accidental loops and credential abuse, independently of your plan or customer size.
| Workload | Default requests per minute | Identity |
|---|---|---|
GET /v1/access | 60,000 | API key |
| Machine mutations, including seat assignment/release and Invitation or Access Code redemption | 6,000 | API key |
| Ordinary developer and Organization-admin reads/mutations | 1,200 | Authenticated user |
| Invitation email creation, Stripe Checkout/Billing Portal, privacy requests/download links, manual Webhook Retry | 60 | Authenticated user |
| Bulk assignment/release, roster preview, review submission/avatar processing | 120 | Authenticated user |
The access budget supports an average of 1,000 authorization checks per second per API key. It has a separate bucket from machine mutations. A human's provider and bulk buckets are separate from ordinary control-plane traffic, and the same user shares their budgets across developer and Organization-admin routes.
When a bucket is exhausted, the API returns the canonical error envelope with 429, rate_limit_exceeded, and a Retry-After header in seconds. Wait at least the indicated delay. Preserve the same logical Idempotency-Key for a durable mutation; the rejected attempt does not acquire a lease or execute the mutation.
These are protective per-API-replica windows, not globally exact distributed quotas. Buckets are temporary and may reset on process restart. Clients must honor each response's Retry-After instead of treating the defaults as guaranteed throughput. Health checks, Stripe webhooks, and bounded anonymous reads have separate infrastructure/provider protections.
Keep these five concepts separate:
- API protective limits control request velocity.
- Supabase Auth limits protect sign-in, sign-up, recovery, verification, and token operations at the identity provider.
- License seat capacity controls active assignments to a License.
- Workspace organization-user capacity controls the Account's canonical organization-user usage.
- Access Code redemption capacity controls lifetime uses of a code.
A 429 does not change License capacity, Workspace capacity, existing access, or billing. No total Organization, License, member, or API-key quota is introduced by these protections.