Rate limits & spend caps

Rate limits#

Each key has a requests-per-minute limit, 600 unless you change it, enforced with a token bucket at the edge. The bucket holds about six seconds of the key’s rate, with a floor of ten requests, so short bursts above the average pass and sustained traffic is held to the rate.

Every response carries X-Ahura-RateLimit-Remaining, the requests left in the bucket right now. Over the limit, the gateway answers 429:

{
  "error": {
    "message": "Rate limit exceeded",
    "type": "rate_limit_error",
    "code": "rate_limit_exceeded",
    "request_id": "…"
  }
}

With Retry-After in seconds. The OpenAI and Anthropic SDKs wait and retry on their own. Rate limits are per key, so two keys on the same organization do not share a bucket; give busy services their own key.

Spend caps#

A hard cap is a monthly amount in your organization’s billing currency at which requests stop. It can be set on a key, on the organization, or both; whichever is reached first applies. Spend counts from the first of the calendar month, UTC, and resets on the next.

{
  "error": {
    "message": "Reached this API key’s monthly hard cap of 100.00 USD for 2026-09. Raise this key’s cap on the API Keys page, or use a different key.",
    "type": "billing_error",
    "code": "hard_cap_reached",
    "scope": "key",
    "spent_cents": 10012,
    "hard_cap_cents": 10000,
    "request_id": "…"
  }
}

• hard_cap_reached: the key’s own cap. Raise it under API keys.
• org_hard_cap_reached: the organization’s cap. Raise it under Inference settings.

A monthly budget is the softer sibling: a figure the dashboard shows spend against and alerts on, without ever blocking a request. Set both: a budget at the number you expect, a hard cap at the number you could not explain.

GET /v1/key returns the calling key’s caps and the month’s spend, so a service can check its own headroom at startup. See Authentication.

Alerts#

As monthly spend crosses 80% and 100% of a budget, or 90% and 100% of a hard cap, the organization is notified on the channels configured under Inference → Notifications: in the dashboard, by email, or to a webhook signed with HMAC-SHA256.