Developer docs
Limits and best practices
Every limit of the Hubs developer platform in one place, and how to build integrations that stay fast and safe.
Limits
| What | Limit |
|---|---|
| Bot calls | 120 a minute per bot, across every hub |
| Bot writes | 30 a minute per bot |
| Hub API key calls | 60 a minute per key |
| Applications | 25 per developer, teams of up to 25 |
| Message text | 4,000 characters |
| Embeds | 5 per message, 6,000 characters in all |
| Component rows | 5 per message, 5 buttons or one menu each |
| Slash commands | 100 global, and 100 per hub |
| Interaction answer | 3 seconds, then 15 minutes for follow-ups |
| Gateway sessions | 16 per bot |
| Gateway frames | 120 a minute, 16 KB each |
| Gateway resume window | 2 minutes |
| Outgoing webhooks | 10 active per hub, and per organization |
| Webhook attempts | 5 per event, 10 seconds each |
| Waiting webhook events | 500, then the webhook pauses |
| Incoming webhooks | 10 per hub, 20 per organization |
| Incoming webhook posts | 30 a minute per hook, 2,000 characters each |
| Hosted app bundle | 40 files, 1 MB in all |
Best practices
- Use the gateway, not polling. Live events cost nothing against your call limit after the connection opens.
- Read the rate limit headers. Slow down when
X-RateLimit-Remaininggets low, and waitRetry-Afterseconds after a 429. - Send an Idempotency-Key with every send, and reuse it when you retry. A retried send then posts once.
- Defer slow work. If an answer takes longer than a moment, answer with
deferat once, then send a follow-up. - Ask for the least you need. Every scope you list is shown to hub admins in plain words. Fewer scopes means more installs.
- Verify every webhook on the raw bytes, refuse old timestamps, and store each event id before acting on it.
- Answer webhooks fast. Return 2xx as soon as the event is stored and do the work afterwards.
- Keep tokens on your server. Never in a web page, a hosted app or a repository. Reset a token the moment you think it leaked.
- Handle removal. A hub can remove your bot at any time. Treat
BOT_NOT_IN_HUBandHUB_DELETEas normal.