Rate limits & throttling
How often you can call each API surface before you get a 429.
On this page
The Domain API (what your Vibe app uses) #
Authenticated data calls your Vibe app makes — reads, writes, workflow triggers, PDFs — are capped at 120 requests per minute per signed-in user token. That is per end-user, not per app: one busy user hitting the cap never affects another.
Sign-in endpoints are throttled tighter and per-IP — login and 2FA verify around 10/min, code resend 3/min, signup and password-reset 5/min — to blunt credential-stuffing. Normal users never notice.
The external Data API (integrations) #
The classic Data API you call with an App Key/Secret from outside tools (Zapier, Make, your own scripts) is throttled by your plan. The limits are per account: every key and every app on the account shares them, so two keys do not double them.
| Tadabase AI plan | Per minute | Per day |
|---|---|---|
| Starter | No API access | — |
| Pro | 120 | 50,000 |
| Team | 240 | 150,000 |
| Business | 480 | 500,000 |
On a Tadabase plan, the limits are the ones set on your plan. The usage panel in Plans & billing shows your own per-minute and per-day numbers next to what you have used.
Responses carry X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After headers (plus daily variants) so a client can back off gracefully. A bigger plan raises both limits.
AI and the build agent #
AI chat and Vibe build runs are not governed by request-per-minute throttling — they are governed by credits and spending caps. There is no 429 on "asking the agent too often"; instead a run stops when it hits a spend cap or your balance. See the Billing & credits section for how that works.