Rate limits and quotas

Most shebang calls have no fixed quota beyond ordinary abuse protection. Two limits are worth knowing about by name.

Email: 10 per account per day

email_send is capped at 10 sends per account per rolling 24 hours, counted from the actual send log — not a flat "resets at midnight." It's also master-key only; an app key gets 403 insufficient_scope regardless of what apps it holds, since there's no email scope to grant.

Exceeding the quota returns 429 {error: "email_quota_exceeded", retry_after_hours}, where the hours count down to when the oldest send in the current 24-hour window ages out — not a flat "come back tomorrow."

Device login: polling backoff

Polling /api/agent-login/token faster than the server's advertised interval (starting at 3 seconds) gets 400 {error: "slow_down", interval} with a larger interval each time, capped at 30 seconds. A well-behaved CLI — including shebang-mcp login — honors this automatically; you'd only see it directly if you were scripting the flow yourself.

The device code itself expires after 10 minutes (expires_in: 600) whether or not you've been polling correctly.

Everything else

Individual API routes carry their own IP-based rate limits — for example, the device-flow endpoints cap unauthenticated attempts per client IP — as abuse protection, not as a per-account budget you're expected to plan around. If you hit one, the response's error names it, and backing off briefly resolves it.