Proof Center · Limits

The real limits, and why each one is that number.

Every limit here is enforced by the same object the dashboard reads, so what is shown is what is applied. CONFIGURED_LIMIT != OBSERVED_CAPACITY: these are the policy the deployment enforces, not a measurement of how hard it can be pushed — that lives in your own project's test center.

Free Beta defaults. Free Beta defaults, as the deployed API reports them. A deployment may raise a default, and an operator may raise one limit for one subject, so these are defaults rather than guarantees. A count limit answers HTTP 409 (a standing count has no clock); a rate, window or concurrency limit answers HTTP 429.

Gateway

Request rate

Limit	Beta default	On refusal	Why this number
Requests a second, per project	5 req/s	HTTP 429	The whole deployment's measured safe sustained rate is 12.1 a second. Five lets two projects run flat out.
Burst, per project	10 req/s	HTTP 429	Twice the sustained rate. The failure above the pool ceiling is a cliff, not a slope, so the burst is deliberately small.
Requests an hour, per project	5,000 req/hr	HTTP 429	Roughly an eighth of the safe hourly rate, leaving headroom for every other project.
Requests in flight, per project	4 concurrent	HTTP 429	The admission pool holds 64 slots and qualification called 22 of them safe. Four per project keeps many projects inside that.
Response bytes an hour, per project	256 MiB/hr	HTTP 429	A window on egress, sized to the Beta host.

Gateway

Account shape

Limit	Beta default	On refusal	Why this number
Organizations per account	2 count	HTTP 409	One to work in and one to try something in. A third is a conversation, not a default.
Members per organization	5 count	HTTP 409	Sized for a team evaluating the API, not for running an organization on it.
Projects per organization	3 count	HTTP 409	A project's measured in-memory ceiling is 10.62 MiB. Three per org keeps a Beta population inside a gigabyte.
API keys per project	5 count	HTTP 409	Rotation needs two live at once; five leaves room and still makes a leaked one easy to find.
Networks per project	6 count	HTTP 409	Six networks carry a commercially available capability here. A seventh is an absence, not a limit.
Products per project	2 count	HTTP 409	XRPC_NODE and XRPC_WALLET are the two products with availability here.
Capabilities on one key	3 count	HTTP 409	Three methods are commercially available on this deployment.

Payments

Limit	Beta default	On refusal	Why this number
Payment watches held, per project	1,000 count	HTTP 409	Watches are held in memory and swept every acquisition pass. Well inside one pass's budget.
Payment watches active, per project	200 concurrent	HTTP 429	An active watch costs upstream calls on every pass across every followed network.
Light acquisition interval	12 seconds/pass	—	One bounded read per followed session per pass. No block scan, no history, no local store.
Session late grace	7 days	—	A payment arriving after the deadline is still recognized as a distinct standing, not silently dropped.
Merchant reference	200 bytes	HTTP 400	An opaque reference echoed back on the session; bounded so it cannot become a store.

Payments

Webhooks and streams

Limit	Beta default	On refusal	Why this number
Webhook endpoints, per project	10 count	HTTP 409	Each endpoint is a destination this deployment retries against. Enough to route by environment.
Delivery attempts, per event	6 attempts	—	Six attempts over roughly half an hour: base 1s, x4 backoff, capped at 15 minutes, with jitter.
Per-attempt timeout	10 seconds	—	A slow endpoint is a failed attempt, retried, not a held connection.
Signature timestamp tolerance	5 minutes	—	A signed delivery older than this is rejected by the receiver as a replay.
WebSocket subscriptions, per project	32 concurrent	HTTP 429	Eight per connection across four connections.

Payments

Retention

Limit	Beta default	On refusal	Why this number
Payment sessions	365 days	—	Sized to the Beta host's disk budget; bounded by record count as well as age.
Payments	365 days	—	The occurrence record behind a receipt is kept for a year.
Usage accounting	90 days	—	One metered event per request, kept a quarter.
Stream cursors	7 days	—	A delivery cursor is short-lived state, not a warehouse.

What a limit is, and is not

A limit reached is not a failure.

Reached, not broken

LIMIT_REACHED != PRODUCT_DEFECT. A count limit answers 409 and a rate limit answers 429, each naming the limit, what is used, and when it resets.

Slowed, not weakened

RATE_LIMITED != SERVER_FAILURE. A rate limit is availability policy, never a worse answer to the question you asked.

Default, not promise

These are Beta defaults. A deployment may raise one, and an operator may raise one for one subject. Nothing here is priced or guaranteed.

Create a free account Limits in the docs