Rate Limits & Quotas
Runne Pass enforces two kinds of limits:
- Per-key rate limits — sliding-window request limits on the chat path.
- Workspace quotas — monthly token budget (enforced) plus declared limits.
Per-key rate limiting
POST /v1/chat/completions is rate-limited per API key. The default is:
| Limit | Default |
|---|---|
requests_per_minute | 60 |
tokens_per_day | 1,000,000 (declared, not enforced in beta) |
You can override these per key at creation via the optional rate_limit object — see API Keys.
Mechanics
- Sliding window implemented as an atomic Redis Lua script (sorted set). Requests older than the window are dropped, and the current count is compared against the limit.
- In-memory fallback is used when Redis is unavailable, so limiting degrades gracefully rather than failing open.
- A request over the limit returns
429(Rate limit exceeded).
Response headers
On the chat path, every response carries:
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Requests allowed per window |
X-RateLimit-Remaining | Requests left in the current window |
X-RateLimit-Reset | Timestamp (ms) when the window resets |
Read X-RateLimit-Remaining and X-RateLimit-Reset before retrying a 429.
Auth rate limiting
Login and registration are rate-limited per IP to slow credential stuffing:
| Endpoint | Limit |
|---|---|
POST /v1/auth/login | 10 / minute |
POST /v1/auth/register | 5 / minute |
Exceeding it returns 429 (Too many attempts).
Workspace quotas
Quotas are workspace-scoped and versioned (each update archives the previous row and inserts a new one with a new effective_from).
Reading quota and usage
curl -b cookies.txt https://api.runne.run/v1/workspaces/WORKSPACE_ID/quota
curl -b cookies.txt https://api.runne.run/v1/workspaces/WORKSPACE_ID/quota/usageThe quota response is { "quota": { … } } (or null when none is set); usage reports the current period's tokens_used and requests_count.
Quota fields
| Field | Enforced in beta? |
|---|---|
tokens_per_month | yes |
requests_per_minute | no (declared) |
max_workspaces | no (declared) |
max_members_per_workspace | no (declared) |
max_api_keys_per_workspace | no (declared) |
tokens_per_month enforcement
The monthly token budget is enforced atomically during settlement: the quota_usage counter is incremented only if the increment would not push usage past the quota (a NOT EXISTS guard inside the update makes the check race-safe). If the quota would be exceeded, the usage increment is skipped.
::: note Quota vs. balance Quota limits consumption; balance limits funds. A request can be quota-limited even with funds available, and vice versa. :::