# Rate Limits & Quotas

Part of the HebrewCore documentation. Web: https://hc.itsbaba.com/docs#limits · Whole docs: https://hc.itsbaba.com/docs.md · Index: https://hc.itsbaba.com/llms.txt

| Limit | Default | Notes |
| --- | --- | --- |
| Request rate | 600 requests / minute per account, across all its keys, on every plan | Exact sliding one-minute window. Returns `429 rate_limited` with a `Retry-After` header in seconds. See `X-RateLimit-*` headers. |
| Monthly characters | Set by your plan (100,000 on Free) | Counts billed characters: input characters times the weight of the endpoint and quality tier (see [Plans & Pricing](https://hc.itsbaba.com/docs#pricing)). Direction, detection, wrap, strip nikud, languages and account terms are not counted. Past the limit, counted requests return `429 quota_exceeded` until the next month or a plan change. |
| Per-request size | 20,000 chars (5,000 for transliterate, 10,000 for nikud, 2,000 for a clinical query) | Analyze accepts up to 100 fields, 20,000 chars total. |

## Response Headers

| Header | On | Meaning |
| --- | --- | --- |
| `X-Usage-Chars-Used` | `translate`, `translate/batch`, `transliterate`, `nikud` | Billed characters used this month by the account, including this request. |
| `X-Usage-Chars-Limit` | `translate`, `translate/batch`, `transliterate`, `nikud` | The account's monthly character quota, in billed characters. |
| `X-RateLimit-Limit` | Authenticated requests | Requests allowed per minute for the key. |
| `X-RateLimit-Remaining` | Authenticated requests | Requests left in the current minute. |
| `X-Content-Stored` | Every endpoint that takes text | Always `false`: HebrewCore never stores the text you send or the result. |
| `Server-Timing` | Authenticated requests | Time spent on our side: `auth`, `ratelimit` and `total`, in milliseconds. |
| `Cache-Control` | Clinical API | Always `no-store`. |

Every metered response includes usage headers:

```http
X-Usage-Chars-Used: 46
X-Usage-Chars-Limit: 100000
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 599
X-Content-Stored: false
```

The response body reports both amounts: `usage.characters` is the length of the input, and `usage.billed_characters` is what the request counted toward the monthly quota. A 23-character protected translation at `balanced` returns:

```text
"usage": { "characters": 23, "billed_characters": 46 }
```

Key revocations and plan changes take effect within 30 seconds.

Authenticated responses also carry a `Server-Timing` header with the time spent on our side, so you can tell it apart from network time when you measure latency from your own region:

```http
Server-Timing: auth;desc="memory";dur=0, ratelimit;dur=0, total;dur=842
```