Documentation

Limits.

Every ceiling here is a billing boundary you chose, a pagination default you can change, or a request rate the API applies to everyone alike. There is no hidden tier, no burst credit that silently runs out, and no ceiling that is set differently for a larger account.

How many keys

Self-serve runs from one key to 50. Your subscription includes the first at $49 per month, and each additional key is $12 per month. You add and remove keys from the service portal in your own account, and the subscription quantity follows.

Removing a key from your subscription is a billing action. Destroying the key material is a separate, deliberate act with a thirty day pending window, described in Keys. Reducing your key count does not silently delete anything.

Operations

Each key bundles 100,000 operations per month. The bundles pool across your account, so five keys give you 500,000 operations to spend wherever they are actually used rather than 100,000 locked to each key.

Past the bundle, operations meter in blocks of 100,000 at $5 per block. Signing counts as two operations and symmetric operations count as one, which reflects what each actually costs to perform.

The prepaid ceiling

Metered usage is prepaid against a ceiling you set, and the ceiling is enforced rather than advisory. When you reach it, further metered operations are refused until you raise it or the billing period turns over. You are not billed past it.

This is a deliberate choice and it cuts both ways. A runaway pipeline cannot generate an invoice you did not agree to, which is the failure mode people actually fear from usage-metered infrastructure. The cost is that a production signing service can stop if you set the ceiling too low and ignore the notices. Set it with headroom, and treat the approach notices as the operational signal they are.

Rate ceilings

Two things refuse a call your subscription would otherwise allow, and both answer 429 rather than queueing it. The first is rate: the API carries a stage-wide request and burst ceiling, with tighter ceilings on the six cryptographic endpoints because those are the calls that reach the module. Retry with backoff and the next window is yours. The second is the prepaid ceiling above, which refuses metered operations once the counter reaches it and clears when the billing period turns over rather than in the next second. One address that keeps drawing refusals is treated as abuse rather than as traffic and is blocked at the edge until the period turns over, never on the strength of a single user, so one person behind a shared office connection cannot get the office blocked. The rate ceilings belong to the API and are identical for every caller; the operations ceiling is the one you set.

Regional add-ons

Serving from more than one region is priced separately from key count, because it replicates infrastructure rather than adding a row:

• An additional served region is $75 per month. This is the region existing as a place your callers can reach.
• A key placed into a served region is $12 per month. Serving a region does not replicate every key into it. You choose which keys go where.
• Failover protection for a region is $49 per month. This is the standby posture, not the serving posture, and it is the only one of the three that is about disaster recovery.

The distinction between serving, placing and protecting is the one most often collapsed into a single idea. It is set out properly in Keys.

Pagination

Listing your keys is the paginated surface. The limit parameter accepts up to 100 items per page and defaults to 20. Asking for more than 100 is refused with a validation error rather than quietly clamped, because a silently reduced page is the kind of thing you find out about in production. Responses carry a continuation token when more results exist, an absent token means you have reached the end, and the token is opaque.

Going past the self-serve range

More than 50 keys is a conversation rather than a checkout, and the reason is honest: at that size the shape of what you need usually stops matching what the self-serve product assumes. Ask us and we will work out the arrangement with you.

The same applies to a region we do not currently serve. The platform is multi-region by construction, so adding one is a deployment rather than a redesign.