Every key — OAuth-issued or dashboard-created — carries two rate limits: per minute and per day. Limits are enforced at the Worker edge.
Tiers
| Tier | Per minute | Per day |
|---|---|---|
| Limited | 60 | 10,000 |
| Pro | 300 | 100,000 |
Dashboard-created keys default to Pro. OAuth-issued keys default to Limited.
Response headers
Every response to /v1/mcp carries:
X-RateLimit-Limit-Minute: 300
X-RateLimit-Remaining-Minute: 287
X-RateLimit-Limit-Day: 100000
X-RateLimit-Remaining-Day: 94812Over the limit
Returns HTTP 429 with:
{ "error": "rate limit exceeded", "retryAfterSec": 42 }The Retry-After header is also set. AI apps surface this as a transient error and retry after the window.