Limits

Use the limits for your actual credential, allow time for larger builds, and retry temporary failures carefully.

Source size

Source length

Value: At most 1,000,000 JavaScript UTF-16 code units after outer whitespace is trimmed.

HTTP text body

Value: The server’s text-body parser has a separate 3 MiB limit. UTF-8 bytes and source character length are different measures.

Accepted content

Value: Non-empty Roblox Luau text. text/plain is recommended.

Limit	Value
Source length	At most 1,000,000 JavaScript UTF-16 code units after outer whitespace is trimmed.
HTTP text body	The server’s text-body parser has a separate 3 MiB limit. UTF-8 bytes and source character length are different measures.
Accepted content	Non-empty Roblox Luau text. text/plain is recommended.

Quota and cooldown

Default web-issued API keys allow five successful requests per reset period, with a 24-hour reset period by default, a 90-second success cooldown and a 30-second code-error cooldown. Administrator-issued keys can have different configured limits.

A processing failure refunds the reserved request credit. Temporary queue or worker failures also restore the request reservation. This does not mean that repeated retries are safe or free of rate limits.

Build time and queueing

Build time varies with source size, protection options and worker load. Requests may wait for capacity, and queue pressure or timeouts can return 503 or 504. There is no guaranteed sub-second build time.

Wait for a request to finish before submitting another with the same key. Use bounded retries and exponential backoff for temporary failures.

Size error handling

The explicit source-length check returns 413. Requests rejected earlier by the body parser or an upstream proxy may use a different status or response format, so clients should also handle non-JSON errors.