# Limits > Every hard cap a box or a workspace can hit, in one place: counts, sizes, windows, and rates, with what the refusal looks like. URL: https://prized.dev/docs/limits Each table links the page that explains the behaviour around it. Money is on [Billing](https://prized.dev/docs/billing): the plan range, top-ups, the rollover cap, and the free credit. ## Boxes [#boxes] | Limit | Value | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Boxes per workspace | 100, counting every box that is not deleted (paused and deep sleep included); 1 on the [free credit](https://prized.dev/docs/billing#free-credit). With an empty balance and no overage nothing starts or wakes ([Running out](https://prized.dev/docs/billing#running-out)) | | Balance to create, wake, or resize | Enough to run the whole resulting fleet for 4 hours ([Starting and resizing boxes](https://prized.dev/docs/billing#starting-and-resizing-boxes)) | | Box name | 1 to 32 characters, lowercase letters, digits, and hyphens, starting and ending with a letter or digit; unique in the workspace | | Sizes | 7, Nano to Extra Large ([Machines](https://prized.dev/docs/machines#sizes)); on the [free credit](https://prized.dev/docs/billing#free-credit), Nano to Small. No resize while provisioning, resizing, or moving; the disk never shrinks ([Resize](https://prized.dev/docs/boxes#resize)) | | Auto-pause window | 30 minutes to 7 days idle; the dashboard offers 30 minutes to 24 hours, the CLI and API the whole range ([Auto-pause](https://prized.dev/docs/boxes#auto-pause)). An [auto-pause floor](https://prized.dev/docs/teams#policies) caps members' boxes. Not available on the [free credit](https://prized.dev/docs/billing#free-credit): those boxes never auto-pause | | Pause deadline | 5 minutes to 30 days ahead, on a running box only ([Pause deadline](https://prized.dev/docs/boxes#pause-deadline)) | | Deep sleep | After 14 days paused the disk is parked as a snapshot; waking takes a few minutes ([States](https://prized.dev/docs/boxes#states)) | | Region moves | 4 per box in any rolling 24 hours, one at a time, running boxes only; 2 regions ([Regions](https://prized.dev/docs/boxes#regions)) | | Undo after delete | 7 days, as a final snapshot under Recently deleted ([Data retention](https://prized.dev/docs/data-retention#deleting-a-box)) | | Capacity | Not a per-workspace number. When no machine of that size is available, a new box waits in `provisioning` and is retried, or ends in `provision_failed` with the reason in its events; delete it and create again, or pick another size | ## Snapshots [#snapshots] | Limit | Value | | ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Manual and template snapshots per workspace | 20. A snapshot still being deleted counts until its storage is released; fork copies, automatic snapshots, and Recently deleted copies never count ([Snapshots](https://prized.dev/docs/snapshots)) | | Snapshot or template name | 1 to 64 characters of letters, digits, `.`, `_`, and `-`, starting and ending with a letter or digit | | Automatic snapshots per box | `keep` of 1 to 10 (default 5), every 1 to 168 whole hours; each expires after keep x interval | | Snapshots in flight per box | 1 | | Fork disk copy | 30 minutes, then the new box is marked failed | | Restore target | Any size whose disk holds the snapshot; a smaller disk is refused with the numbers | | Region | A snapshot restores into the region its box was in | | Balance | Any snapshot needs a funded balance or an active plan | ## Environments [#environments] | Limit | Value | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | Environment name | 1 to 64 characters of letters, digits, `.`, `_`, and `-`, starting and ending with a letter or digit ([Environments](https://prized.dev/docs/environments)) | | Env vars per environment | 64, each value a single line of up to 4,096 characters | | Per-box vars | 100 names and 64 KiB of names and values together, inside the launch budget | | Repos per environment | 16, each with an optional setup script of up to 8 KiB | | Secret files per environment | 16, each up to 64 KiB, at a path of up to 256 characters | | Setup script | 16 KiB | | Launch budget | The environment plus the box's own vars must fit 16 KiB compressed; a save or create that would not is refused as `environment_too_large` | | Versions kept | 50 per environment; older ones no live box pins are pruned | ## Commands and files [#commands-and-files] `prized exec`, `prized cp`, the edge API, and the dashboard's Files tab ([Run commands and files](https://prized.dev/docs/exec)). | Limit | Value | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Synchronous run | 600 seconds through the API (default 30); `prized exec` has no limit unless you pass `--timeout` | | Output kept per stream | The last 1 MiB, flagged as truncated | | Exec request document | 1 MiB | | Environment variables per run | 32 | | Inline file read or write | 1 MiB | | Upload or download | 1 GiB, and 30 minutes per request. A directory download that reaches the cap is cut off, so a truncated archive never looks complete | | Detached process log tail | 16 KiB by default, 1 MiB at most. The process itself has no time limit, and its logs are never deleted for you | | Concurrent requests | 8 per token and 8 per box | | Request rate | 20 per second sustained, bursts of 40, per token and per box; over it answers `429 rate_limited` with `Retry-After` | | JSON request body | 64 KiB on most `/api/v1` routes; 128 KiB on the secrets routes; 2 MiB on the environment routes | | Dashboard Files tab | 1 MiB in the inline editor; 100 MiB per upload or download; one operation at a time per tab; a folder listing shows 2,000 entries and marks itself truncated past that | ## Prompting an agent remotely [#prompting-an-agent-remotely] | Limit | Value | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | Prompt | 512 KiB ([Prompt an agent remotely](https://prized.dev/docs/remote-agents)) | | Runs in progress per box | 1. A second start answers `409 prompt_in_progress` unless it asks to be queued ([One run at a time](https://prized.dev/docs/remote-agents#one-run-at-a-time-and-a-queue)) | | Runs listed | 50, newest first; older run directories stay on the box | | Events per page | 200 by default, 1,000 at most, or 1 MiB, whichever comes first; one event of any size is always delivered | | Event text | 8 KiB per event (the `raw` line is kept whole); a single event over 32 MiB cannot be delivered | | Requests | As for commands and files above | ## Sync, sessions, and ports [#sync-sessions-and-ports] | Limit | Value | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | File size in a synced project | 256 MB; larger files are skipped and named by `prized sync ls` ([Sync](https://prized.dev/docs/sync#add-a-project)) | | First sync | Up to 3 minutes for the box to install the sync agent and move the first bytes before it is called broken | | Drag-and-drop upload | 512 MB per drop, one file or several; drops older than 7 days are cleaned out ([Sessions](https://prized.dev/docs/sessions#drag-files-in)) | | Mirrored ports | 3000 through 9999 by default; never below 1024, never 22 or 7377; 5900 off by default; TCP only ([Ports](https://prized.dev/docs/ports#limits)) | ## Desktop [#desktop] | Limit | Value | | -------------------- | -------------------------------------------------------------------- | | Per box | One desktop and one browser window ([Desktop](https://prized.dev/docs/desktop#limits)) | | Screen | 1920x1080, scaled to your window; VNC, no audio, no GPU | | Browser profile name | Letters, digits, `-` and `_`, up to 64 characters | ## Secrets and access [#secrets-and-access] | Limit | Value | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | Secrets per workspace | 100 ([Secrets for agents](https://prized.dev/docs/credentials#secrets-for-agents)) | | Secret name and value | The name is `SCREAMING_SNAKE`, a letter first, up to 128 characters; the value up to 16 KiB | | Allowlisted hosts per secret | 32 | | Secret grants | Each names one box or one member; a secret with none is available to every box except a contractor's ([Scoped secrets](https://prized.dev/docs/teams#scoped-secrets)) | | Secret usage | Counts are a floor; the usage read returns up to 1,000 rows ([Usage](https://prized.dev/docs/teams#usage)) | | SSH certificates | 15 minutes each, minted for you as you connect | | Phone access password | One per box, no expiry; generating a new one, or revoking, replaces it everywhere ([From your phone](https://prized.dev/docs/codex#from-your-phone)) | | Phone access gateway | 8 connections per box at once; a connection with nothing running on it closes after 15 idle minutes | ## Workspace [#workspace] | Limit | Value | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CLI tokens | No cap; revoke any from **Dashboard → Workspace → CLI tokens** ([CLI tokens](https://prized.dev/docs/workspaces#cli-tokens)) | | Members | No cap | | Invite link | Does not expire; replaced by **New link** or by removing a member ([Invite people](https://prized.dev/docs/workspaces#invite-people)) | | Workspace icon | 1 MiB per upload | | Startup deal link | 30 days ([Custom plans](https://prized.dev/docs/billing#custom-plans)) | | Spend per member | Off, or 1 to 1,000,000 whole dollars a billing cycle ([Policies](https://prized.dev/docs/teams#policies)) | | Boxes per member | Off, or 1 to 100 live boxes (running or paused) | | Largest size per member | Off, or any size | | Auto-pause floor | Off, or 30 minutes to 7 days | | Quiet hours | Off, or one `HH:MM` to `HH:MM` window a day in one IANA timezone, per weekday, with all-day days; a box woken inside it stays up 15 minutes ([Quiet hours](https://prized.dev/docs/teams#quiet-hours)) | | Audit log retention | 7 to 365 days, 90 by default ([Audit log](https://prized.dev/docs/teams#audit-log)) | | Audit log reads | 100 rows a page by default, 1,000 at most per request; the CSV carries up to 50,000 rows | | Audit export | An `https` URL of up to 2,048 characters on a public host, and a secret of 16 to 256 characters; 500 events a delivery, 20 deliveries an hourly pass, 10 seconds a request ([Scheduled export](https://prized.dev/docs/teams#scheduled-export)) | | Reported audit detail | 16 keys of up to 40 characters, strings up to 512 characters, a body up to 64 KiB | ## Not allowed [#not-allowed] Cryptocurrency mining, on the free credit or on any plan. A box found mining pauses every box in its workspace, and creating, restoring, forking, waking, resizing, or moving one answers `409 workspace_held`. Nothing is deleted and no credit is taken. Paying does not lift it and neither does deleting the box: email the support address shown on https://prized.dev/docs/troubleshooting for a review. ## Retention [#retention] Box metrics 30 days, sign-in records 90 days, CLI usage aggregates 90 days, audit rows 90 days by default (7 to 365 by policy), finished deletion operations 30 days. The windows and their zero data retention variants are on [Data retention](https://prized.dev/docs/data-retention#telemetry-retention-windows). ## How limits fail [#how-limits-fail] | Where | What you see | | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The API | The HTTP status and an `error` code, with a message that quotes the numbers: `409 box_limit`, `409 insufficient_balance`, `409 trial_no_auto_pause`, `429 snapshot_limit`, `402 secret_limit`, `400 invalid_name`, `400 invalid_auto_pause`, `400 invalid_pause_at`, `400 environment_too_large`, `400 too_many_repos`, `400 too_many_files`, `409 prompt_in_progress`, `413 payload_too_large`, `403 policy_denied` (with `rule` and `message`), `403 secret_not_granted`, `429 rate_limited` with `Retry-After` | | The CLI | The [exit code table](https://prized.dev/docs/cli#for-agents-and-scripts): a value outside a range is `USAGE` (2) before anything is sent; the box count, a taken name, or a balance that cannot run the box is `CONFLICT` (6); the snapshot limit and a refused lifecycle change are `CHECK_FAILED` (5) with the control plane's sentence. `--json` carries the same code and message in `error` | | The dashboard | The same sentence next to the control that asked, or the control is not offered: a size the balance cannot run cannot be picked, and the pause deadline is hidden on a paused box |