Plans and help
Limits
The limits that apply to keys, requests and accounts.
- Request bodies that are checked: 1 MB for Stripe, 25 MB for the AI providers (32 MB for Anthropic), 50 MB for AWS, 10 MB for everything else. Uploads with nothing in them to check stream straight through, up to 100 MB: S3 objects sent with
x-amz-content-sha256: UNSIGNED-PAYLOAD, and binary bodies (files, images, video) for custom APIs. They need aContent-Length. - Methods: GET, POST, PUT, PATCH, DELETE and HEAD (judged by the rules as GET), and OPTIONS for browsers' preflight checks. Ghost keys stay on servers; web pages and apps use short-lived keys.
- Paths must start with the provider's usual prefix (such as
/v1/). Percent-escapes are allowed except encoded slashes, backslashes and dots. - With
allowedModelsset, file and audio uploads are refused, because their model cannot be read. - JSON bodies are forwarded re-encoded, so integers larger than 2^53 lose precision.
- While a request is being forwarded, the real key is decrypted in memory for that moment only.
Still have a question?
We read every email, usually within a day.