Rate limits
The request, creation and sending limits a MepMail deployment enforces — and how to work within them.
MepMail enforces limits at four layers: HTTP request rate, credential protection, resource creation, and sending volume.
HTTP request rate
- 600 requests per minute per API key (deployment default,
API_RATE_LIMIT_PER_MINUTE). Past it the API answers429 rate_limit_exceeded. - Responses do not currently carry
RateLimit-*headers: treat any429as the signal to back off with exponential delay and retry.
Credential protection
- Repeated failed authentication attempts from one source are throttled with a
429("Too many failed authentication attempts"). This limit exists to make brute force pointless — stop retrying wrong credentials.
Resource creation
- 10 domains per hour per team. Creating a sending identity provisions a shared AWS SES resource, so the cap keeps one team from exhausting the account's quota. It resets hourly.
Sending volume
| Plan | Included | Period | Past the cap |
|---|---|---|---|
| Free | 100 | UTC day | Sends park (50% grace before stopping) |
| Starter | 1,500 | UTC day | Sends park (50% grace before stopping) |
| Pro / Scale | purchased volume | month | Overage billed per 1,000 when enabled; otherwise stops |
- Monthly plans with overage enabled still hard-stop at 5× the included volume: a runaway integration (or a stolen key) can never produce an open-ended bill.
- The per-second send rate is bounded by the deployment's SES quota — 14/s by default, following the account's real SES rate as it scales. Broadcasts are paced to leave transactional headroom (a 30% reserve by default).
Message shape limits
- 50 recipients per email (
to+cc+bcccombined). - 100 emails per batch call; an over-cap array is a
422. - Attachments (summed across the message, measured after decoding): 1 MB on Free and Starter, 5 MB on Pro, 10 MB on Scale.
Limits by plan (objects)
- Contacts: 1,000 on Free, 10,000 on Starter, unlimited from Pro up.
- Sender domains: 1 / 3 / 10 / unlimited (Free / Starter / Pro / Scale).
- Teams per user: 1 / 2 / 5 / 10.
See Billing for prices and the full ladder.
MCP
- 600 calls per minute per account on the hosted MCP endpoint
(deployment default), then
429 rate_limit_exceeded. - Dynamic client registration for MCP OAuth is rate-limited per address; a client that needs to register again should reuse its existing registration.