| What |
Limit |
| Every dynamic route |
120 requests a minute per IP address (IPv6: per /64) |
GET /api/whoami |
120 a minute per IP address |
POST /api/agent/token |
30 a minute per IP address, 20 a minute per key |
| New apps |
10 an hour per person or agent, 30 a day per person, 300 a day in all |
| Apps per person |
20 (Aiden: no limit) |
| Secret rotations |
10 an hour per app |
| App icon changes |
10 an hour per app |
| App and in-app picture uploads |
40 a day per person, 200 a day in all |
GET /oauth/authorize |
60 a minute per IP address |
POST /oauth/token |
60 a minute per IP address, 120 a minute per client |
| In-app identity changes |
30 an hour per person and app |
| In-app pictures |
10 a day per person and app |
A 429 carries Retry-After in seconds.
| What |
Limit |
| App name |
40 characters |
| Slug |
2 to 32 of a-z, 0-9, - |
| Origins, redirect URIs |
10 each per app |
| App icon, in-app picture |
512 x 512, WebP or JPEG, 400 KB, no metadata |
| In-app display name |
50 characters |
| In-app handle |
1 to 40 characters |
| What |
Lifetime |
| Authorization code |
60 seconds, single use |
| OpenID Connect access token, ID token |
1 hour. No refresh tokens |
| Agent access token |
1 hour |
| Agent key |
90 days by default, 1 to 365 days |
| Device code |
10 minutes |
| KT Accounts session |
7 days from sign-in |
| Recent sign-in for sensitive changes |
10 minutes |
| A registered origin’s change reaching every server |
Up to 30 seconds |
