GitLab.com will adjust its rate‑limit system so that limits match a user’s subscription tier. The change begins with free accounts and unauthenticated traffic on October 19, 2026. Before that, two preview windows—sometimes called brownouts—will let users test the new limits: October 7 and October 14, each from 15:00 to 19:00 UTC. During these windows the limits are turned on and then off again, with no other service changes. Unauthenticated requests will be capped at 60 requests per hour per IP address, regardless of where they originate. Authenticated requests will receive limits based on the user’s subscription: free, Premium, or Ultimate, applied per user and per top‑level group. Premium and Ultimate limits will not change until January 2027, but they are already higher than the free tier and match or exceed what similar platforms offer for enterprise tiers. The limits were set after analyzing actual GitLab.com usage; GitLab says most users already operate within the new thresholds and will see no difference in day‑to‑day activities such as browsing the UI, using Git, or running CI/CD jobs. Users who approach a limit will receive an HTTP 429 response with a Retry‑After header, allowing clients to back off and retry. To avoid hitting the anonymous cap, users should authenticate requests via personal access tokens, OAuth tokens, or CI/CD job tokens, which moves the traffic onto the higher subscription‑based limits. Additional strategies include batching calls, caching results, and using pagination instead of tight polling loops. Upgrading to a Premium or Ultimate subscription raises the per‑user and per‑group limits, and GitLab notes it is working on a way to purchase extra capacity above the standard plan limits, with details to come later in 2026. The change applies only to GitLab.com; self‑managed and dedicated installations are unaffected. For concerns about legitimate anonymous traffic—such as public status badges—users can contact [email protected].
Key facts
- Free and unauthenticated rate limits take effect October 19, 2026
- Preview windows for testing occur October 7 and October 14, 15:00–19:00 UTC
- Unauthenticated requests limited to 60 requests per hour per IP
- Authenticated limits follow subscription tier (Free, Premium, Ultimate) per user and per top‑level group
- Premium and Ultimate limits change in January 2027
- HTTP 429 with Retry‑After indicates limit exceeded
- Authenticating requests raises limits to subscription level
- Upgrade or purchasing extra capacity can increase limits further