> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beta.b3os.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform limits and FAQ

Limits for keys, projects, CLI tokens, webhook secrets and the request log in the beta, and answers to common questions about the account side.

## Limits

The organization-wide rate, concurrency and quota limits are on [limits](/concepts/limits). These are the platform's own:

| Limit | Value |
|---|---|
| Key and project `name` | 100 characters |
| `metadata` on any object | 16 pairs; keys up to 40 characters, values up to 500 characters |
| Request body for keys, projects and organizations | 16 KiB |
| CLI token from `b3os login` | 90 days by default; you choose 1 to 365 days when you approve it |
| Email sign-in code | 6 digits, valid for 10 minutes |
| Webhook URL | 2,048 characters |
| Webhook secret rotation, `grace_s` | Up to 7 days; a day by default |
| Job webhook deliveries | Answer with a `2xx` within 10 seconds; failures are retried with backoff for 24 hours |
| Webhook delivery history | 7 days |
| Request log | 7 days |
| Idempotency keys | 24 hours, per project |

## FAQ

**Why can my first key not create keys or read webhook secrets?**

The key you get when you redeem your invite has every product scope but not `platform:write`, `vault:write` or `*`. Create a key with `platform:write` in the [dashboard](https://beta.b3os.org/app), and keep it out of your agents' hands.
  **Can I change a key's scopes?**

No. Scopes are fixed when the key is created. Create a key with the scopes you want, deploy it, then revoke the old one. `PATCH` changes only the name, spend cap, expiry and metadata.
  **What happens when I revoke a key?**

Requests with it fail at once, and streams it opened close within a minute. Routines published with it pause their triggers until you publish a new version with a valid key. The revoked key stays listed for audit.
  **Why does a call from my sandbox return 421 edge_only?**

Keys, usage, limits, organizations, projects and the pack registry are served at `https://beta-api.b3os.org` only, not on the node. Call them there with a key.
  **Why is a request missing from GET /v1/requests?**

The list holds what the node served. Requests the edge answered by itself, such as key management or a request refused before it reached the node, are not listed; fetch them by their `x-request-id` with `GET /v1/requests/{request_id}`.
  **Do two spellings of one URL share a webhook secret?**

Yes, when they differ only in the case of the scheme and host or in a default port: B3OS lowercases both and drops the port before it looks up the secret. Any other difference, such as a trailing slash or a query string, is a different URL with its own secret.
  **Where do the dashboard's sign-in options come from?**

The dashboard signs you in with GitHub or with a 6-digit code sent by email, then keeps a session cookie. The CLI uses a device login instead, and code uses API keys. See [platform](/platform#signing-in).