> ## Documentation Index
> Fetch the complete documentation index at: https://uselora.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> How Lora throttles requests and what to do when you hit the cap.

Rate limits are per key, not per user or per workspace. Use a separate key per integration so one integration cannot consume another's budget.

## Plan limits

The workspace plan sets the budget for every active key:

| Plan                    | Requests per key | Window   |
| ----------------------- | ---------------- | -------- |
| Free                    | API unavailable  | —        |
| Basic                   | 600              | 1 minute |
| Business and Enterprise | 1,500            | 1 minute |

The counter resets when its one-minute window rolls. Plan changes synchronize the cap on existing keys as well as new ones. Per-key overrides aren't available in the settings UI.

## When you hit the limit

You get `429 Too Many Requests` with a `Retry-After` header in seconds:

```json theme={null}
{
  "error": "Too many requests",
  "code": "rate_limit_exceeded",
  "requestId": "fra1::iad1::abc123"
}
```

Wait the indicated number of seconds, then retry. Add jitter so concurrent workers do not retry at once:

```ts theme={null}
async function callWithRetry(url: string, init: RequestInit, attempt = 0) {
  const response = await fetch(url, init);
  if (response.status !== 429 || attempt >= 4) {
    return response;
  }
  const retryAfter = Number(response.headers.get("retry-after") ?? "1");
  const jitter = Math.random() * 500;
  await new Promise((r) => setTimeout(r, retryAfter * 1000 + jitter));
  return callWithRetry(url, init, attempt + 1);
}
```

## Choosing a key budget

A few guidelines:

* For an interactive integration like an internal tool or one-user script, use the plan limit as-is.
* For background jobs and batch operations, pace the worker fleet so the combined rate for one key stays below its plan limit.
* Do not embed workspace API keys in browser extensions, public widgets, or other untrusted clients. Keep keys on a trusted server and proxy requests through your backend.