# Limits and quotas

> Monthly browser-hours and egress, concurrency, session length, idle timeout, token lifetime, retention and egress rules of OpenWAF Browsers in the beta.

During the public beta OpenWAF Browsers is free within the quota below. These are the defaults for every organization. An operator can adjust them for yours: write to support@openwaf.dev.

## Quota per organization

| Item | Default | Counted as |
|---|---|---|
| Browser-hours | 20 per month | Time of every browser from the moment Chrome is ready until it stops, idle time included; start-up time is not counted |
| Egress | 5 GB per month | Bytes uploaded plus bytes downloaded through the egress proxy (1 GB = 10⁹ bytes) |
| Concurrent browsers | 2 per key | Browsers running at the same time with one key |
| Session length | 60 minutes | Per browser, then it stops |
| Keys | 5 | Keys of the organization |

`GET /v1/orgs/{org}/browsers` returns the quota in `quota` and the month to date in `usage`. The dashboard shows both on **Browsers → Overview**.

## The monthly cycle

1. **The month is a calendar month in UTC.** It starts on the 1st at 00:00 UTC. `period.start` and `period.end` give the exact bounds.
2. **At 80 %** of browser-hours or of egress, `warning` turns `true` and the dashboard shows a warning. Nothing stops.
3. **At 100 %** of either, every key of the organization is disabled and its running browsers stop. `status` becomes `quota_exceeded` and the keys show `disabled: true`. New browsers are refused with `401`.
4. **On the 1st of the next month at 00:00 UTC** the keys are enabled again automatically. You do not need to do anything.


Usage is collected every minute, so the figures in the dashboard and the API lag by up to about two minutes. For the same reason, browsers can keep running for up to about two minutes past 100 % before they are stopped.

## Browser lifetime

| Item | Value |
|---|---|
| Idle timeout | 120 seconds with no CDP or live view client, unless you set `timeout` or `keepAlive` |
| Maximum session length | 60 minutes |
| CDP and live view tokens | 1 hour; `GET /v1/browsers/{id}` returns fresh ones |
| Session files (recordings, downloads) | Kept 7 days after the browser stops |
| Profiles | One browser at a time; deleting one in use answers `409` |

Closing the CDP connection does not stop a browser. Stop it with `PATCH /v1/browsers/{id}` `{"action": "stop"}` so it does not count idle time.

## Shared capacity

In the beta, all organizations share the browser nodes: up to 5 browsers run at the same time across the service. When they are all busy, `POST /v1/browsers` answers `429` with `{"code": "capacity_busy"}` and `Retry-After: 30`. Wait and retry: it does not count against your quota. `capacity` in the overview shows the current state (`max_sessions`, `running`, `busy`).

This is different from your own limit of 2 browsers per key, which answers `429` with `{"code": "key_concurrency"}`.

## Egress rules

Every request of the browser goes through the egress proxy:

- **Ports 80 and 443 only.**
- **Always denied**, whatever the settings: private addresses (RFC 1918), loopback, link-local (including the cloud metadata address `169.254.169.254`), CGNAT (`100.64.0.0/10`), multicast, documentation and other special-purpose ranges, and their IPv6 equivalents. The proxy resolves the names itself; if any address of a name is denied, the name is denied.
- **Open mode** (the default) allows any other public host. **Allowlist mode** allows only the hosts an admin lists: `example.com` for that host, `*.example.com` for its subdomains, up to 100 entries.
- **Every request is logged**: time, key, browser, method, host, port, decision, reason, status, bytes and duration. Read it with `GET /v1/browsers/{id}/egress`, the [organization egress log](https://developers.openwaf.dev/browsers/reference/#egress) or **Browsers → Egress log**.

The browser cannot reach your own machine or private network. To test a site that is not public, publish it on a public host name first.

## Location

Browsers, recordings, downloads and logs are hosted in the EU, in Germany.