---
title: Limits
description: Rate limits on the identity and access API, plan limits on
  workspaces, environments, members and invitations, and how long credentials
  and tokens last.
url: https://hexelstudio.com/docs/identity/limits
---

Hexel Studio applies three kinds of limits:

- **Rate limits** cap how many requests a caller and an organization can make per minute.
- **Plan limits** cap how many workspaces, environments, members and invitations an organization can have.
- **Credential lifetimes** decide how long API keys and tokens stay valid.

## Rate limits

Rate limits apply to the identity and access API: every route under `https://api.hexelstudio.com/v1/` for organizations, members and invitations, workspaces, environments, users, policies, groups, roles, service users and their credentials, access checks, audit logs and quotas.

Requests are counted per calendar minute, for the caller (the user, service user or role session in the token) and for the caller's organization. A request must fit within every limit that applies to it:

| Limit | Counts | Per minute |
| --- | --- | --- |
| Reads per caller | `GET` and `HEAD` requests | 300 |
| Writes per caller | `POST`, `PUT`, `PATCH` and `DELETE` requests | 120 |
| Sensitive writes per caller | Writes to API keys and OAuth clients (`/v1/service-users/{id}/api-keys`, `/v1/service-users/{id}/oauth-clients`), policies (`/v1/policies`), organization members and invitations, workspace members, and `/v1/invitations` | 20 |
| Reads per organization | Reads by every caller in the organization together | 3,000 |
| Writes per organization | Writes by every caller in the organization together | 600 |

A sensitive write counts against both the writes limit and the sensitive writes limit. A request sent with an API key counts for the key's service user.

If your organization needs higher read or write limits, contact Hexel Studio. The sensitive writes limit is the same for everyone.

### Token service limits

| Limit | Value |
| --- | --- |
| Tokens issued by `POST https://sts.hexelstudio.com/token` | 60 per minute for one credential: one API key, one OAuth client, or one signed-in person |
| Invalid API keys sent in `X-API-Key` | About 20 failed attempts per minute from one IP address; after that, keys from that address are refused until the limit refills |

Reuse an access token for its 15 minutes instead of requesting one per call, and the token limit won't affect you.

### When you hit a rate limit

The API answers `429 Too Many Requests`:

```json
{
  "error": {
    "code": "429",
    "message": "Rate limit exceeded. Try again later."
  }
}
```

| Header | Meaning |
| --- | --- |
| `Retry-After` | Seconds until the current minute ends and the count starts again |
| `X-RateLimit-Limit` | The limit you hit |
| `X-RateLimit-Scope` | Which limit: `principal_reads`, `principal_writes`, `principal_sensitive_writes`, `org_reads` or `org_writes` |

The token service answers `429` with a body of its own:

```json
{
  "error": "rate_limited",
  "error_description": "too many tokens issued for this credential; retry later"
}
```

Wait for `Retry-After` seconds before you retry. Retrying sooner is refused again and still counts.

## Plan limits

Some creates count against a limit of your organization's plan. These are the defaults:

| Limit | Key | Default | Counts |
| --- | --- | --- | --- |
| Workspaces per organization | `workspaces_per_org` | 3 | Workspaces in the organization, including **Default** |
| Environments per workspace | `environments_per_workspace` | 2 | Environments in the workspace |
| Members per organization | `members_per_org` | 5 | Members plus pending invitations |
| Invitations per day | `invitations_per_day` | 10 | Invitations sent or resent in a 24-hour window |

Your organization's limits can differ from the defaults. [Read your organization's limits](#read-your-organizations-limits) to see the values that apply to you.

A few consequences of the defaults:

- A new organization already has one workspace, **Default**, so you can create two more.
- The **Default** workspace starts with two environments, **Production** and **Development**, so it's already at the default environment limit.
- A pending invitation holds a member slot until it's accepted, revoked or expires. Accepting it doesn't use a second slot.

A limit applies only to new creates. If your organization is already above a limit, you keep what you have.

### When you hit a plan limit

The create is refused with `403`, even when the caller is allowed to make it:

```json
{
  "error": "quota_exceeded",
  "quota_key": "workspaces_per_org",
  "limit": 3,
  "current": 3,
  "message": "plan limit reached: this organization can have at most 3 workspaces; upgrade the plan or contact Hexel"
}
```

| Field | Meaning |
| --- | --- |
| `quota_key` | The limit you reached |
| `limit` | Your organization's limit |
| `current` | How many you have now |

To create more, delete something you no longer need, or contact Hexel Studio.

### Read your organization's limits

Any access token or API key of your organization can read its effective limit for a key. No policy is needed.

```bash
curl https://api.hexelstudio.com/v1/quotas/orgs/$ORG_ID/limits/workspaces_per_org \
  -H "X-API-Key: $API_KEY"
```

```json Response
{
  "org_id": "org_7b2e4c1a9d8f4e3b8c6a5d4e3f2a1b0c",
  "quota_key": "workspaces_per_org",
  "limit": 3,
  "source": "default"
}
```

| Field | Meaning |
| --- | --- |
| `limit` | The limit that applies. `-1` means unlimited. |
| `source` | Where it comes from: `default`, `billing_plan` (your plan) or `override` (set by Hexel Studio for your organization) |

`$ORG_ID` must be your own organization: the one in your token or API key. Another organization's ID answers `403`, and an unknown key answers `404` with `"error": "unknown_quota_key"`.

## Credential and token lifetimes

| Credential | Lifetime |
| --- | --- |
| API key | Every key expires. Without an `expires_at`, a key lasts 90 days. You can choose a date up to the end of the UTC day 365 days from now; a date in the past, or later than that, is refused with `400`. Keys created before 14 October 2026 may have no expiry; replace them. |
| Access token | 15 minutes |
| Refresh token (people only) | Single use; the chain lasts at most 30 days and never past your sign-in deadline |
| Role session | 1 hour by default; up to the role's maximum, at most 12 hours |

See [Access tokens](https://hexelstudio.com/docs/identity/tokens) for how tokens are renewed and revoked, and [Service users and API keys](https://hexelstudio.com/docs/identity/service-users) for rotating keys before they expire.