Rate limits and scaling with Cloudsmith
Cloudsmith applies rate limits to ensure reliability, security and consistent performance for all users. These limits help protect against abusive or accidental overuse. Most users will never encounter rate limits, and if your workloads require more capacity, we'll adjust them. Contact us and we'll work with you to configure limits to match your requirements.
Cloudsmith web app and API
Cloudsmith applies default request limits based on how you access the platform. Authenticated usage is the preferred way to use Cloudsmith. It provides higher throughput, better security, and a more reliable experience for production workloads.
The table below shows the baseline defaults:
| Description | Rate limit |
|---|---|
| Non-authenticated/anonymous users (by IP address) via API | 1,800 req/hour (0.5 req/sec) |
| Authenticated users on a Core plan via API | 5,400 req/hour (1.5 req/sec) |
| Authenticated users on Pro, Velocity, Ultra or Enterprise plans via API | 50,000 requests per 5 minutes |
| Authenticated app.cloudsmith.com usage | 50,000 requests per 5 minutes |
| Package downloads | 50,000 requests per 5 minutes |
Limits expressed per 5 minutes use a 5-minute sliding window. 50,000 requests per 5 minutes is equivalent to 10,000 requests per minute of sustained throughput, and if you hit the limit, requests are accepted again within minutes rather than at the end of an hour-long window.
Package downloads
Package downloads have a default limit of 50,000 requests per 5-minute sliding window (equivalent to 10,000 requests per minute), applied per user or token, per region. For unauthenticated downloads the limit is applied per IP address.
Two things to note about how this limit works:
- Only requests that reach our origin count toward the limit. The majority of package downloads are served directly from our CDN cache, and cached responses do not count. In practice this means your effective download capacity is significantly higher than the headline number.
- The 5-minute sliding window absorbs bursts. A short spike in download traffic, such as a large CI fan-out, stays within the limit as long as the total over any 5-minute period is under 50,000 origin requests. If you do hit the limit, requests are accepted again within minutes rather than being throttled for the remainder of an hour.
Package metadata APIs
Cloudsmith provides native endpoints for different package formats (for example, npm, Docker, Maven, NuGet, and more). These endpoints have a default throttle of 1,512,000 requests per hour (per region, per user, and per workspace). This can be customized dynamically, applying to all package formats.
Need higher limits?
Cloudsmith regularly customizes limits to support customer use cases. If your workloads need more capacity, contact us and we'll be happy to adjust limits to fit your needs.
Suspicious traffic
In addition to rate limits, Cloudsmith monitors traffic patterns to protect the platform against abuse. If traffic looks suspicious, for example, unusually high request volumes from a single source or patterns consistent with automated abuse, you may be asked to complete a challenge before further requests are processed.
Legitimate authenticated usage is unlikely to be challenged. If traffic from your organization is being challenged and you believe it is legitimate, contact us and we'll work with you to resolve it.
Monitoring your usage
Each API response includes headers to help you monitor and manage usage. These can be used in automated workflows to prevent disruptions and optimize performance:
| Header | Meaning | Example |
|---|---|---|
| X-RateLimit-Limit | The maximum number of requests that the client is permitted to send in the current window. | 600 |
| X-RateLimit-Remaining | The number of requests that are remaining in the current rate limit window. | 588 |
| X-RateLimit-Reset | The UTC epoch timestamp at which the current rate limit window will reset. | 1485706850 |
| X-RateLimit-Interval | The time in seconds that the client must wait until the next request in order to avoid consuming too much within the rate limit window. | 0.98256663893 |
For authorized requests:
$ curl -H "x-api-key: csa_NOPE" -i http://api.cloudsmith.io/user/self/ -L --verbose 2>&1 | grep -i x-rate
< x-ratelimit-interval: 0
< x-ratelimit-limit: 50000
< x-ratelimit-remaining: 49999
< x-ratelimit-reset: 1786544720
x-ratelimit-interval: 0
x-ratelimit-limit: 50000
x-ratelimit-remaining: 49999
x-ratelimit-reset: 1786544720For unauthorized requests:
$ curl -i http://api.cloudsmith.io/user/self/ -L --verbose 2>&1 | grep -i x-rate
< x-ratelimit-interval: 0
< x-ratelimit-limit: 1800
< x-ratelimit-remaining: 1796
< x-ratelimit-reset: 1786547900
x-ratelimit-interval: 0
x-ratelimit-limit: 1800
x-ratelimit-remaining: 1796
x-ratelimit-reset: 1786547900If the client has exceeded the rate limit in a particular rate limit window, a 429 Too Many Requests status code will be sent instead of acting upon the request. The body response will be JSON encoded and include a detail message:
curl -i http://api.cloudsmith.io/user/self/
HTTP/1.0 429 Too Many Requests
Allow: GET, OPTIONS
Content-Type: application/json
Retry-After: 212
Vary: Cookie
x-content-type-options: nosniff
X-Frame-Options: SAMEORIGIN
X-RateLimit-Interval: 211.5
X-RateLimit-Limit: 50000
X-RateLimit-Remaining: 0
X-RateLimit-Reset: <unix-epoch-seconds>
Date: <response-date>
{
"detail": "Request was throttled. Expected available in 212.0 seconds."
}Scaling with Cloudsmith
Our goal is to give every team a reliable, predictable platform that can meet its needs, without surprises. Rate limits protect Cloudsmith and our users. If your workflows require more capacity, we'll work with you to ensure you always have the limits you need.