.png){kind=logo}
PluginReference
Limits and roadmap
Rate limits, size limits, the signature window, plan allowances, and what is not available yet.
Rate limits
All limits answer 429 with a Retry-After header.
| Surface | Limit | Keyed on |
|---|---|---|
| Session creation | 10 per minute | plugin and IP address |
| Session creation | 100 per hour, 1000 per day | plugin |
| Embedded API | 120 per minute | session token |
| Image uploads | 20 per minute, 200 per hour | session token |
| AI text generation | 20 per minute, 200 per hour | session token |
| AI text generation | 2000 per day | plugin |
| Backend API | 60 per minute, 2000 per day | plugin id, failed attempts included |
The editor opens one session per iframe, so normal use stays far below the session limits.
Size and count limits
| What | Limit |
|---|---|
| Identity signature lifetime | 15 minutes ahead of now |
| Domains per plugin | 25 |
| Wildcard domain depth | One label |
| Curated categories per list | 100 |
| Template markup | 5 MB |
| Image | 5 MB; PNG, JPEG, GIF, WebP |
| Images per batch upload | 10 |
| Images per batch delete | 50 |
| Logo | 2 MB; PNG, JPEG, WebP, SVG |
| AI message | 5000 characters |
| AI prompt | 2000 characters |
| Versions retained per template | 30 |
| Plugin name | 255 characters |
Plan allowances
Plans are Free and Pro. Figures are on the Plan & Billing tab and returned by the plans endpoints.
| Feature | Counts |
|---|---|
users | Distinct external_user_id values with at least one saved template. Unsaved visitors and anonymous sessions do not count |
ai_generations | Successful generations. Unlimited on every plan, since they run on your own provider key |
image_storage | Bytes on MailEditor storage. Uploads to a custom bucket are not counted |
When a request would exceed an allowance the API answers 402 quota_exceeded with result.feature naming it. Existing users are never locked out by the users allowance; only new users are refused.
Not yet available
| Capability | Status |
|---|---|
| Deleting a template | Templates can be created, read and saved. Deletion is not exposed on any surface |
| Domain verification | Every session reports the development tier. The tier does not restrict anything |
| JavaScript SDK and iframe events | The iframe emits no events. Read saved work through the Backend API |