---
title: Rate limits and quotas
description: Email's 10-per-day cap, and the device-login flow's polling backoff.
---

# Rate limits and quotas

Most shebang calls have no fixed quota beyond ordinary abuse
protection. Two limits are worth knowing about by name.

## Email: 10 per account per day

`email_send` is capped at 10 sends per account per rolling 24 hours,
counted from the actual send log — not a flat "resets at midnight." It's
also **master-key only**; an app key gets `403 insufficient_scope`
regardless of what `apps` it holds, since there's no `email` scope to
grant.

Exceeding the quota returns `429 {error: "email_quota_exceeded",
retry_after_hours}`, where the hours count down to when the *oldest*
send in the current 24-hour window ages out — not a flat "come back
tomorrow."

## Device login: polling backoff

Polling `/api/agent-login/token` faster than the server's advertised
`interval` (starting at 3 seconds) gets `400 {error: "slow_down",
interval}` with a larger interval each time, capped at 30 seconds. A
well-behaved CLI — including `shebang-mcp login` — honors this
automatically; you'd only see it directly if you were scripting the flow
yourself.

The device code itself expires after 10 minutes (`expires_in: 600`)
whether or not you've been polling correctly.

## Everything else

Individual API routes carry their own IP-based rate limits — for
example, the device-flow endpoints cap unauthenticated attempts per
client IP — as abuse protection, not as a per-account budget you're
expected to plan around. If you hit one, the response's `error` names
it, and backing off briefly resolves it.