# Rate limits, 429s and credit guards

Limits keep one runaway agent from draining your credits or the service. They apply per **API key** and per **OAuth connection**, and depend on your plan; using the app in your browser isn't metered.

## Limits by plan

| Surface | Free | Agency plans | Resets |
| --- | --- | --- | --- |
| REST API | 60 requests an hour, **read-only** (GET) | 600 requests a minute | when the window ends |
| MCP (AI assistants) | not included | 60 calls a minute per key (Agency Pro and Scale) | 60 seconds after the first call |

On Free, requests that change something (POST, PATCH, PUT, DELETE) return **403** with an upgrade hint; use the app instead. Admins can lower a key's per-minute rate (`rate_per_min`) and give it a daily cap (`rate_per_day`, resets 00:00 UTC) under **API keys**, or with `update_api_key`. REST and MCP are counted separately.

## What counts

- Every REST request and every MCP HTTP request counts **1**.
- MCP tools that spend credits (`submit_index_job`, `check_index`, `retry_job`, `send_unindexed_to_indexer`) weigh **5** in total.

## When you hit a limit

The response is **429** with a `Retry-After` header (seconds). REST errors include `error.retry_after` and `error.details` (`code: "rate_limited"`, the plan and the limit); MCP returns a JSON-RPC error. Successful API-key responses carry `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` and `X-RateLimit-Window` (minute or hour).

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 23
RateLimit-Limit: 60
RateLimit-Remaining: 0
```

Agents should wait `Retry-After` seconds and retry once, not loop.

## Plan limits (403 / 429 with an upgrade hint)

Features that aren't on your plan return **403** with `error.details.code = "plan_required"` and `required_plan`; limits you're over return **429** with `error.details.code = "plan_limit"`. Both carry the `feature` (for example `max_urls_per_job`, `workspaces`, `seats`, `live_checks`, `mcp`, `concurrent_jobs`) and an `upgrade_url`. Free allows 50 URLs per push or check and 3 running at a time.

## Credit guards

- **Two kinds of credits:** index credits (1 per URL pushed, charged only if it gets indexed; the credit comes back automatically if it isn't indexed after 7 days) and check credits (1 per Standard check, 5 per Live check). Not enough of either returns **402** with `error.details.kind`.
- **Confirmation:** an MCP call that would spend more than 1,000 credits returns `needs_confirmation` with the estimate instead of running. Ask the user, then call again with `confirm_spend: true`.
- **Daily credit cap per key:** set `daily_credit_cap` on a key and calls that would take it over the cap for the UTC day return 429 with a plain explanation.
- **Hard limits:** 10,000 URLs per job on paid plans; a job never spends more credits than your balance (402 otherwise).


---
Source: https://freshlycited.com/docs/rate-limits