| 1 | --- |
| 2 | title: Rate limits |
| 3 | description: How many requests the API, the MCP server, git over HTTPS and the site take a minute, what a limited request is answered with, and how to stay under the limits. |
| 4 | --- |
| 5 | |
| 6 | g1t limits how many requests a client can make in a minute, so that one |
| 7 | client cannot slow g1t down for everyone else or run up a repository |
| 8 | owner's bill. The limits are well above what a person or an agent working |
| 9 | normally reaches. Each counts requests over 60 seconds, approximately: a |
| 10 | client can sometimes get a few more through before it is limited. |
| 11 | |
| 12 | ## Response headers |
| 13 | |
| 14 | REST and MCP responses that pass through an available rate limiter include |
| 15 | `RateLimit-Policy`. Its Structured Fields syntax follows the IETF HTTPAPI |
| 16 | [RateLimit draft](https://www.ietf.org/archive/id/draft-ietf-httpapi-ratelimit-headers-10.html), |
| 17 | which is not yet a published RFC: |
| 18 | |
| 19 | ```http |
| 20 | RateLimit-Policy: "anonymous";q=60;w=60 |
| 21 | ``` |
| 22 | |
| 23 | Authenticated requests use `"token";q=1000;w=60`. Quotas are approximate |
| 24 | per-location limits, not a global accounting balance. Cloudflare's binding |
| 25 | does not expose a remaining count or reset clock, so successful responses |
| 26 | do not invent those values. A limited response is HTTP 429 and includes: |
| 27 | |
| 28 | ```http |
| 29 | RateLimit-Policy: "anonymous";q=60;w=60 |
| 30 | RateLimit: "anonymous";r=0;t=60 |
| 31 | Retry-After: 60 |
| 32 | ``` |
| 33 | |
| 34 | Wait at least `Retry-After` seconds, then retry with jitter. These headers |
| 35 | are exposed to browser API clients through CORS. Exempt service callbacks |
| 36 | and self-hosted installations without a working limiter omit the policy. |
| 37 | |
| 38 | ## Limits |
| 39 | |
| 40 | | Where | Counted by | Requests a minute | |
| 41 | | --- | --- | --- | |
| 42 | | REST API, with a token | Token | 1,000 | |
| 43 | | REST API, without a token | Client IP address | 60 | |
| 44 | | MCP server | Token | 1,000 | |
| 45 | | Git over HTTPS, with credentials | Credentials | 1,200 | |
| 46 | | Git over HTTPS, without credentials | Client IP address | 120 | |
| 47 | | Anonymous clones of one repository that are not cached | Repository | 120 | |
| 48 | | Pages on g1t.sh, signed in | Session | 1,200 | |
| 49 | | Pages on g1t.sh, [with a token](/guides/authentication/#use-a-token-on-the-website) | Token | 1,000 | |
| 50 | | Pages on g1t.sh, signed out | Client IP address | 600 | |
| 51 | | [Ask g1t](/guides/ask/) questions | Person | 20 | |
| 52 | | Archive downloads, workflow run pages, log downloads and search, signed out | Client IP address | 30 | |
| 53 | | [Raw files](/guides/git/#raw-files) on g1tusercontent.com | Client IP address, together with pages signed out | 600 | |
| 54 | | [OpenTelemetry ingest](/guides/observability/) at otel.g1t.sh | Client IP address | 600 | |
| 55 | | Container and package registries | See [storage and pull limits](/guides/containers/#storage-and-pull-limits) | | |
| 56 | |
| 57 | The REST API and the MCP server count apart: calls to one do not use up |
| 58 | the other's limit. A request with a token that is not valid counts against |
| 59 | its IP address, as a request without a token does. On g1t.sh, every |
| 60 | request from one IP address, signed in or not, also counts toward 3,000 a |
| 61 | minute. |
| 62 | |
| 63 | Signing up with a password is limited to 5 accounts an hour from one |
| 64 | network; see [too many attempts](/guides/authentication/#too-many-attempts). |
| 65 | |
| 66 | A running job's live log, which its run's page asks for about once a |
| 67 | second, counts as a page, not as a log download. |
| 68 | A signed archive link, the address |
| 69 | `GET /repos/{owner}/{repo}/tarball/{ref}` and `/zipball/{ref}` send you to, |
| 70 | counts by the link, at the token rate, rather than by address: jobs that |
| 71 | share an address, as g1t's own machines do, each download their tarball |
| 72 | without using up each other's limit. |
| 73 | |
| 74 | Workflow jobs report to g1t with their own |
| 75 | credentials. Those reports are not rate limited. |
| 76 | |
| 77 | ## When you are limited |
| 78 | |
| 79 | A request past a limit is answered `429 Too Many Requests` with a |
| 80 | `Retry-After` header: the number of seconds to wait before trying again. |
| 81 | |
| 82 | ```http |
| 83 | HTTP/1.1 429 Too Many Requests |
| 84 | Retry-After: 60 |
| 85 | Content-Type: application/json |
| 86 | |
| 87 | { "error": { "code": "rate_limited", "message": "Too many requests with this token. Wait a minute and try again: https://docs.g1t.sh/reference/rate-limits/" } } |
| 88 | ``` |
| 89 | |
| 90 | | Where | Body | |
| 91 | | --- | --- | |
| 92 | | REST API and MCP server | JSON in the [error shape](/reference/api/#errors) every endpoint uses, with `code` `rate_limited`. Through MCP it comes back as the HTTP answer to the request, not as a tool result. | |
| 93 | | Git over HTTPS | Plain text, which git prints after `remote:` or in its error. | |
| 94 | | Pages on g1t.sh, and raw files | Plain text. | |
| 95 | |
| 96 | Branch on the `429` status or the `rate_limited` code, never on the |
| 97 | message. The API sends `Access-Control-Expose-Headers: retry-after`, so a |
| 98 | browser app can read the header too. |
| 99 | |
| 100 | ## Staying under the limits |
| 101 | |
| 102 | - **Send a token.** Signed-in limits are much higher than anonymous ones, |
| 103 | and they follow the token rather than the network you are on, so people |
| 104 | sharing an office or a VPN do not share a limit. |
| 105 | - **Clone with credentials.** A clone is about three git requests. Use |
| 106 | [a token as the password](/guides/git/#authentication) to count against your own |
| 107 | limit rather than your network's. |
| 108 | - **Wait for `Retry-After`.** Retrying sooner is answered `429` again and |
| 109 | counts against the limit. |
| 110 | - **Cache what does not change.** A commit's contents never change: read |
| 111 | a commit by its SHA once and keep it. |
| 112 | - **Use webhooks instead of polling.** A [webhook](/guides/webhooks/) |
| 113 | tells you when something changes, without a request a minute. |
| 114 | |
| 115 | Repeated anonymous clones of the same commit are answered from a cache and |
| 116 | do not count against the repository's limit. If a limit gets in the way of |
| 117 | something you need to do, [contact support](https://g1t.sh/support). |
| 118 | |
| 119 | ## Running g1t yourself |
| 120 | |
| 121 | An installation you run yourself has no rate limits. See |
| 122 | [run g1t yourself](/guides/self-hosting/). |