Rate limits and monthly usage
Troubleshoot Qubeforms rate limits, monthly submission quotas, and draft storage limits. Identify the restriction, respect retry windows, and resume submissions safely.
1. Identify which limit was reached
Read error.message and error.details on a 429 response. The same HTTP status is used for submission velocity, monthly accepted usage, and draft or spam storage limits. When present, Retry-After gives seconds until another attempt is appropriate. Do not assume every 429 means a plan upgrade is needed.
2. Wait for a request-rate window
The default submission velocity is 20 attempts per 600 seconds per form/IP; Pro and Business can use configured limits. Idempotent replays consume attempts too. Draft saves have a separate default of 60 attempts per 600 seconds. Shared networks or a backend proxy can put multiple visitors into one apparent IP bucket. Disable duplicate clicks, stop retry loops, and save drafts at step boundaries rather than on every keystroke.
3. Check account-wide monthly usage
Open Overview for the owner’s account. Accepted non-spam submissions share the monthly allowance across all owned forms: 100 Free, 1,000 Starter, 10,000 Pro, or 50,000 Business. Wait until the next UTC calendar month or change plans through Subscription. Archiving or deleting accepted records does not restore quota. Creating another form does not provide more allowance. See Manage your plan.
4. Handle draft and spam storage limits
Draft creation and quarantined spam have separate per-form daily storage ceilings, even though they do not count as accepted monthly submissions. If their error message names a daily limit, honor the returned delay and investigate repeated creates or abusive traffic. Update a known draft instead of creating one for every save. Increasing the final submission retry rate will not resolve a storage limit.
5. Resume carefully
Preserve the visitor’s fields and, for an uncertain final submission, the original idempotency key and payload. Wait at least the supplied delay, then allow a bounded retry. If no delay is present, inspect the message and usage before scheduling another request. When a limit persists unexpectedly, give support the UTC time, form, status, sanitized message, and observed request frequency.
Public form keys can appear in browser code. Read keys, management credentials, and webhook signing secrets must stay on the server.