Limits
Rate limits, size limits, counts, timeouts and lifetimes that apply to apps using the SDK, taken from the SDK and the server. Server numbers are defaults that can change.
Request rates
All of these count per app and person: two people using your app do not share a budget, and your app does not share one with another app. A 429 carries Retry-After (seconds) and becomes RateLimited with retryAfterSeconds.
| What | Limit | Window |
|---|---|---|
| Every call of the REST API | 120 requests | 1 minute |
Publishing posts (createPost) | 10 posts | 10 minutes |
| Publishing posts, in total | 100 posts | 1 day |
Every answer also carries X-RateLimit-Limit and X-RateLimit-Remaining for the 120-requests-per-minute budget.
Write actions
On top of the budgets above, actions that change things have their own limits. Each kind has a short window and a daily total.
| Kind | Short window | Per day | Covers, for example |
|---|---|---|---|
| Reactions | 60 per minute | 2,000 | Likes and unlikes, the bell on a post, installing sticker packs, "not interested" |
| Comments | 20 per 10 minutes | 200 | Writing and editing comments |
| Follows | 30 per 10 minutes | 300 | Following and unfollowing, the profile bell, follow requests, removing a follower |
| Safety | 30 per 10 minutes | 200 | Blocking, muting, reports |
| Profile | 10 per hour | 30 | Editing the profile, removing the banner |
| Settings | 30 per 10 minutes | 300 | Changing settings, muted keywords |
The exact set of calls under each kind can change.
Lookups
Calls that ask an outside provider have a small budget of their own, per minute:
| Call | Limit | Window |
|---|---|---|
| Search | 30 | 1 minute |
| Places search | 20 | 1 minute |
| GIF search | 30 | 1 minute |
| Sticker packs | 30 | 1 minute |
Per address
These limits count per IP address, not per person. Many people behind one address (an office, a mobile network) share them.
| What | Limit | Window |
|---|---|---|
| The REST API (read limiter) | 10,000 requests | 15 minutes |
The sign-in token endpoint (/oidc/token, including token introspection) | 600 requests | 15 minutes |
The authorization endpoint (/oidc/auth) | 600 requests | 15 minutes |
| The sign-in pages | 300 requests | 15 minutes |
| Password, key and 2FA steps on the sign-in page | 50 attempts | 15 minutes |
Use retries to let the SDK wait out a 429 for you, and cache what you can. A server that verifies tokens with verifyAccessToken should cache the answer for a short while rather than ask for every request, because each check is a request to the token endpoint.
Sizes
| What | Limit |
|---|---|
A whole upload request (createPost with media) | 250 MB |
| A profile picture or banner | 10 MB |
| A JSON request body | 10 MB |
| Pictures in one post | 10 |
| Pictures in one comment | 3 |
| A comment | 2,000 characters |
| Links on a profile | 5 |
A picture that is too large is answered with payload_too_large (413). Everything uploaded passes the same scans, size limits and moderation as in the UNET apps. See Media.
Counts
| What | Limit |
|---|---|
| Pinned posts | 3 by default (pin_limit_reached beyond that, with the limit in the answer) |
| Comment edit window | 30 minutes after posting |
| Posts watched by one realtime stream | 12 |
| Realtime streams per person, app and kind | 3 (a new one replaces the oldest) |
Page sizes
Lists take a limit, and the server keeps it between a minimum and a maximum. A few that are fixed in the server:
| List | Default | Range |
|---|---|---|
postLikes, postReposts, commentLikes, commentReposts | 30 | 1 to 100 |
placePosts | 20 | 1 to 30 |
hashtagPosts, topicPosts | 20 | 1 to 30 |
mutualConnections | 30 | 1 to 50 |
notInterestedItems | 50 | 1 to 100 |
For the others, ask for what you show, and use paginate() or the cursor or offset in each answer. See Calling the API.
Timeouts and times
In the SDK
| What | Value |
|---|---|
A JSON request (timeoutMs) | 60 seconds. Uploads, media downloads and realtime streams have none. |
| Renewing the access token | A minute before it ends |
| A pending sign-in | 15 minutes |
| The cached discovery document | 1 hour |
The cached signing keys (verifyIdToken) | 10 minutes; an unknown key id triggers at most one new fetch every 30 seconds |
Clock difference accepted by verifyIdToken | 60 seconds |
| Longest access token the server-side check accepts | 2,048 characters |
Longest ID token verifyIdToken accepts | 8,192 characters |
On the server
| What | Default |
|---|---|
| Authorization code | 10 minutes |
| Access token | 1 hour |
| ID token | 1 hour |
| Refresh token | 60 days, renewed each time it is used |
| The person's permission for your app (the grant) | 180 days |
| The person's browser session on UNET | 14 days |
| Reuse window for a just-used refresh token | 60 seconds |
See Tokens for what these mean.
Realtime
| What | Value |
|---|---|
| A stream's lifetime | 50 minutes, then the server ends it and the SDK reconnects at once |
| A keep-alive comment | Every 20 seconds |
| Waiting before a reconnect | 1 second, doubling to 30 seconds (minDelayMs, maxDelayMs) |
| Streams in total, on the server | 5,000 |