Limits and quotas
Every bound the service enforces, in one table.
| Field | Bound |
|---|
name | 3–100 characters |
description | up to 500 characters |
instructions | 20–20,000 characters |
model | 1–200 characters, must exist in the directory |
schedule.cron | 5–120 characters, exactly five fields |
schedule.timezone | 1–100 characters, a valid IANA identifier |
limits.maxSteps | 1–25 |
limits.timeoutSeconds | 30–1200 (20 minutes) |
variables | any JSON object; only strings and numbers substitute |
webhookUrl | a valid URL |
| Field | Bound |
|---|
name | 2–100 characters |
url | a valid URL, up to 2,048 characters |
headers | up to 50 entries |
| header name | 1–100 characters |
| header value | up to 4,096 characters |
| Field | Bound |
|---|
name | 2–100 characters |
| Property | Value |
|---|
| Name | 1–80 characters |
| Scopes | at least one, from the seven available |
| Format | wor_<prefix>_<secret> — 10 hex characters, then a 24-byte base64url secret |
| Storage | SHA-256 hash only; plaintext shown once |
| Bound | Value |
|---|
| Model steps per run | the routine's maxSteps, at most 25 |
| Wall clock per run | the routine's timeoutSeconds, at most 1,200 seconds |
| Stored run output | truncated at 100,000 characters |
| Worker concurrency | bounded; runs are claimed atomically from Postgres |
| Operations tick interval | one minute |
| Bound | Value |
|---|
| Rate limit | per credential, fixed 60-second window |
| Rate limit headers | X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After on 429 |
| Request body | 1 MB on /v1 |
| CORS | the configured UI_ORIGIN only, with credentials |
The rate limit key combines the project, the credential kind, and the
credential identity — so two API keys in the same project have independent
budgets, and a session does not consume a key's allowance.
| Bound | Value |
|---|
| Attempts | 4 |
| Backoff | 30 seconds, doubling per attempt, capped at 30 minutes |
| Jitter | added to every scheduled retry |
| Request timeout | 10 seconds |
| Replay window | 5 minutes, enforced by the receiver against the timestamp |
| Redirects | not followed |
| Bound | Value |
|---|
state life | 10 minutes |
state use | single use, bound to the user and the active project |
| PKCE | S256 for PostHog; GitHub OAuth apps use the client secret |