The server enforces these limits.
Requests and uploads
| Limit | Value | Applies to |
|---|
| JSON request body | 256 KiB | Every /v1 JSON request. Images upload separately. |
| One image | 8 MiB, at least 1 byte | POST /v1/uploads. Live value: uploads.maxBytes in GET /v1/config. |
| Image types | JPEG, PNG, WebP | Live list: uploads.contentTypes. |
| Upload ticket | 5 minutes | The signed uploadUrl. |
| Attachment view | 15 minutes | The signed view URL. |
| Request timeout | 30 seconds | Server request handling. |
| CORS preflight cache | 10 minutes | Access-Control-Max-Age: 600. |
Send the exact Content-Type and Content-Length from the ticket with the
upload. Attachment kinds are file, capture and captureCrop. The older
names screenshot and screenshotCrop are still accepted.
Reactions and projects
| Limit | Value |
|---|
| Emoji | 12 code points and 64 UTF-8 bytes. Plain ASCII and keycaps are refused. |
| Names listed per reaction | 12. count is still the full count. |
| Project name | 1 to 100 characters, one line |
Connected agents
| Limit | Value | Applies to |
|---|
| Threads per list | 25 by default, at most 100 | list_threads. Follow nextCursor. |
| One tool call | 25 seconds | Every tool on /mcp. A call still running after that stops with TOOL_TIMEOUT. Wait a few seconds, then call it again. |
| One wait | 20 seconds, the default and the most | wait_for_threads then returns an empty list. waitSeconds can shorten it. |
| Agent reply | 4,000 characters | Replies, summaries and reopen reasons. Longer text is shortened. |
| Changed files named | 3 | A resolve summary names three and counts the rest. |
| Screenshot link | 15 minutes | Signed URLs from get_thread. |
| Access token | 1 hour | Bearer token on /mcp. |
| Refresh token | 30 days since last use | Each refresh starts a new 30 days. |
| Authorization code | 5 minutes | Used once at /oauth/token. |
| Approval page | 15 minutes | Start again from the client after that. |
| Client registrations | 30 per hour per IP address | /oauth/register. |
| Redirect URIs | 10 per client | /oauth/register. |
| Client name | 100 bytes | Shown on approval and on replies. |
Identity
| Limit | Value |
|---|
| Max token age (own identity provider) | 1 to 60 minutes. Default 5. |
Future iat allowed | 2 minutes |
| Commenter session length | 1 to 720 hours in the dashboard. Default 7 days. Renewed after half its life. |
| Own-identity-provider session | 12 hours, or the project’s session length if shorter. Not renewed. |
If an upload or capture is incomplete
- No paperclip in the composer means this deployment has no image storage.
unsupported_type or too_large describe the file. Convert HEIC, SVG and
PDF to JPEG, PNG or WebP.- If the ticket works but the
PUT fails, check the storage response and the
CSP: storage must be in connect-src and img-src.
- A page capture rebuilds the page from the DOM. Cross-origin images, video,
canvas and WebGL, and content in shadow roots can be missing. The note still
posts without the image.