| 1 | --- |
| 2 | title: Rate limits |
| 3 | description: How many requests the API, the MCP server, git over HTTPS and the site take a minute, what a limited request is answered with, and how to stay under the limits. |
| 4 | --- |
| 5 | |
| 6 | g1t limits how many requests a client can make in a minute, so that one |
| 7 | client cannot slow g1t down for everyone else or run up a repository |
| 8 | owner's bill. The limits are well above what a person or an agent working |
| 9 | normally reaches. Each counts requests over 60 seconds, approximately: a |
| 10 | client can sometimes get a few more through before it is limited. |
| 11 | |
| 12 | ## Limits |
| 13 | |
| 14 | | Where | Counted by | Requests a minute | |
| 15 | | --- | --- | --- | |
| 16 | | REST API, with a token | Token | 1,000 | |
| 17 | | REST API, without a token | Client IP address | 60 | |
| 18 | | MCP server | Token | 1,000 | |
| 19 | | Git over HTTPS, with credentials | Credentials | 1,200 | |
| 20 | | Git over HTTPS, without credentials | Client IP address | 120 | |
| 21 | | Anonymous clones of one repository that are not cached | Repository | 120 | |
| 22 | | Pages on g1t.sh, signed in | Session | 1,200 | |
| 23 | | Pages on g1t.sh, [with a token](/guides/authentication/#use-a-token-on-the-website) | Token | 1,000 | |
| 24 | | Pages on g1t.sh, signed out | Client IP address | 600 | |
| 25 | | Archive downloads, workflow run pages, log downloads and search, signed out | Client IP address | 30 | |
| 26 | | [Raw files](/guides/git/#raw-files) on g1tusercontent.com | Client IP address, together with pages signed out | 600 | |
| 27 | | [OpenTelemetry ingest](/guides/observability/) at otel.g1t.sh | Client IP address | 600 | |
| 28 | | Container and package registries | See [storage and pull limits](/guides/containers/#storage-and-pull-limits) | | |
| 29 | |
| 30 | The REST API and the MCP server count apart: calls to one do not use up |
| 31 | the other's limit. A request with a token that is not valid counts against |
| 32 | its IP address, as a request without a token does. On g1t.sh, every |
| 33 | request from one IP address, signed in or not, also counts toward 3,000 a |
| 34 | minute. |
| 35 | |
| 36 | Signing up with a password is limited to 5 accounts an hour from one |
| 37 | network; see [too many attempts](/guides/authentication/#too-many-attempts). |
| 38 | |
| 39 | A running job's live log, which its run's page asks for about once a |
| 40 | second, counts as a page, not as a log download. |
| 41 | A signed archive link, the address |
| 42 | `GET /repos/{owner}/{repo}/tarball/{ref}` and `/zipball/{ref}` send you to, |
| 43 | counts by the link, at the token rate, rather than by address: jobs that |
| 44 | share an address, as g1t's own machines do, each download their tarball |
| 45 | without using up each other's limit. |
| 46 | |
| 47 | Agents' sandboxes and workflow jobs report to g1t with their own |
| 48 | credentials. Those reports are not rate limited. |
| 49 | |
| 50 | ## When you are limited |
| 51 | |
| 52 | A request past a limit is answered `429 Too Many Requests` with a |
| 53 | `Retry-After` header: the number of seconds to wait before trying again. |
| 54 | |
| 55 | ```http |
| 56 | HTTP/1.1 429 Too Many Requests |
| 57 | Retry-After: 60 |
| 58 | Content-Type: application/json |
| 59 | |
| 60 | { "error": { "code": "rate_limited", "message": "Too many requests with this token. Wait a minute and try again: https://docs.g1t.sh/reference/rate-limits/" } } |
| 61 | ``` |
| 62 | |
| 63 | | Where | Body | |
| 64 | | --- | --- | |
| 65 | | REST API and MCP server | JSON in the [error shape](/reference/api/#errors) every endpoint uses, with `code` `rate_limited`. Through MCP it comes back as the HTTP answer to the request, not as a tool result. | |
| 66 | | Git over HTTPS | Plain text, which git prints after `remote:` or in its error. | |
| 67 | | Pages on g1t.sh, and raw files | Plain text. | |
| 68 | |
| 69 | Branch on the `429` status or the `rate_limited` code, never on the |
| 70 | message. The API sends `Access-Control-Expose-Headers: retry-after`, so a |
| 71 | browser app can read the header too. |
| 72 | |
| 73 | ## Staying under the limits |
| 74 | |
| 75 | - **Send a token.** Signed-in limits are much higher than anonymous ones, |
| 76 | and they follow the token rather than the network you are on, so people |
| 77 | sharing an office or a VPN do not share a limit. |
| 78 | - **Clone with credentials.** A clone is about three git requests. Use |
| 79 | [a token as the password](/guides/git/#authentication) to count against your own |
| 80 | limit rather than your network's. |
| 81 | - **Wait for `Retry-After`.** Retrying sooner is answered `429` again and |
| 82 | counts against the limit. |
| 83 | - **Cache what does not change.** A commit's contents never change: read |
| 84 | a commit by its SHA once and keep it. |
| 85 | - **Use webhooks instead of polling.** A [webhook](/guides/webhooks/) |
| 86 | tells you when something changes, without a request a minute. |
| 87 | |
| 88 | Repeated anonymous clones of the same commit are answered from a cache and |
| 89 | do not count against the repository's limit. If a limit gets in the way of |
| 90 | something you need to do, [contact support](https://g1t.sh/support). |
| 91 | |
| 92 | ## Running g1t yourself |
| 93 | |
| 94 | An installation you run yourself has no rate limits. See |
| 95 | [run g1t yourself](/guides/self-hosting/). |