> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mibyanai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Limits, budgets, and security

> Protect production projects from misuse and unexpected spend

The default project policy is 60 requests per minute and 100,000 tokens per minute. Rate-limit responses use HTTP `429`, include `rate_limit_exceeded`, and expose limit, remaining, and reset headers.

A project can monitor a monthly budget or enforce a hard limit. A hard limit rejects new billable requests after recorded monthly estimated spend reaches the configured amount.

## Security checklist

* Keep keys on the server.
* Use separate test and live credentials.
* Apply least privilege and model or endpoint restrictions.
* Configure an appropriate budget.
* Monitor logs and audit activity.
* Revoke exposed or unused keys immediately.

<Info>
  Policies can differ by project or organization. Read response headers instead of hard-coding the default limits.
</Info>