Rate limits & throttling
How often you can call each API surface before you get a 429.
On this page
The Domain API (what your Vibe app uses) #
Authenticated data calls your Vibe app makes — reads, writes, workflow triggers, PDFs — are capped at 120 requests per minute per signed-in user token. That is per end-user, not per app: one busy user hitting the cap never affects another.
Sign-in endpoints are throttled tighter and per-IP — login and 2FA verify around 10/min, code resend 3/min, signup and password-reset 5/min — to blunt credential-stuffing. Normal users never notice.
The external Data API (integrations) #
The classic Data API you call with an App Key/Secret from outside tools (Zapier, Make, your own scripts) is throttled by your plan, per account:
| Window | Default | Set by |
|---|---|---|
| Per minute | 60 requests | Your plan |
| Per day | 1,000 requests | Your plan |
Responses carry X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After headers (plus daily variants) so a client can back off gracefully. Higher plans raise these numbers; some plans set them to unlimited.
AI and the build agent #
AI chat and Vibe build runs are not governed by request-per-minute throttling — they are governed by credits and spending caps. There is no 429 on "asking the agent too often"; instead a run stops when it hits a spend cap or your balance. See the Billing & credits section for how that works.