# Rate limits

> What each Pidgeon plan allows — addresses, storage, daily sending and API calls — read as this page renders from the module the API enforces.

Three things limit what an account can do, and the effective limit is always
the lowest of them: the plan, the trust tier, and the per-minute rate limit.

## Per plan

| Limit                              | Free             | Developer           | Startup                | Enterprise             |
| ---------------------------------- | ---------------- | ------------------- | ---------------------- | ---------------------- |
| People in the workspace            | 1                | 10                  | 25                     | Unlimited              |
| Domains                            | 1                | 10                  | 150                    | Unlimited              |
| Mailboxes                          | 3                | 10                  | 150                    | Unlimited              |
| Programmable addresses             | 3 (1 to start)   | 10 (1 to start)     | 150 (10 to start)      | Unlimited              |
| Webhook endpoints                  | 3                | 25                  | 100                    | Unlimited              |
| API keys                           | 10               | 10                  | 50                     | Unlimited              |
| Requests per minute                | 120              | 1,200               | 3,000                  | 6,000                  |
| Messages sent per day              | 100 (6 to start) | 1,000 (66 to start) | 15,000 (1000 to start) | 50,000 (3333 to start) |
| Messages sent per month            | 3,000            | 10,000              | 450,000                | 1,500,000              |
| Pods                               | 3                | 10                  | 25                     | Unlimited              |
| Routing rules per domain           | 25               | 200                 | 1,000                  | Unlimited              |
| Storage, shared across the account | 3 GB             | 10 GB               | 500 GB                 | 1,000 GB               |
| Inbound                            | Unlimited        | Unlimited           | Unlimited              | Unlimited              |

Receiving is free on every plan, because charging for the thing that makes an
inbox valuable would be the wrong business.

Every number above is read, as this page renders, from the same module the API
enforces them from — so this table cannot describe a limit the product does not
apply. It used to claim that while being a hand-written table that did not.

**Programmable addresses and daily sends are a ceiling, not an allowance.** A
trust tier grants a share of the number above. A new account starts with the
share in the *start* column, which is a fifteenth; ordinary standing is a
third, and an established account gets all of it.

## Trust, which is not the plan

A brand-new domain cannot be made trustworthy overnight. A new account starts
well below its plan's daily allowance and earns its way up as its mail is
delivered and read, rather than being handed a large limit it could burn its
reputation with on the first day.

Verifying your domain raises it. So does time, and so does mail that arrives
without being reported. Nothing you can do makes it instant, and a product
that claimed otherwise would be selling you a blocklisting.

## Rate limits

Per minute, per account, across every key.

**A refusal tells you when to come back.** Being refused carries
`Retry-After` in seconds and the daily allowance alongside it, so a client
that has hit a limit never has to guess how long to wait:

```http
Retry-After: 85783
X-RateLimit-Limit-Day: 6
X-RateLimit-Remaining-Day: 0
X-RateLimit-Reset-Day: 1792170122
```

The send allowance is a **rolling** twenty-four hours, not a calendar day, so
`X-RateLimit-Reset-Day` is when your oldest send ages out of the window —
which is the only honest answer and is why it is a header rather than a rule
you could work out yourself.

Every authenticated success also carries `X-RateLimit-Limit`, `-Remaining`
and `-Reset` for the per-minute ceiling, so a client can pace itself rather
than find the limit by hitting it ([the headers](https://pidgeon.ai/docs/errors.md)).

## When you hit one

An entitlement refusal is a `402` with a sentence naming the limit and the
alternative — routing an extra address into an inbox you already have is free,
and is usually what somebody at the mailbox limit actually wanted.