Limits
Every hard cap in Charming, in one place, with what to do when you hit one.
Storage and files
| What | Cap | What to do when you hit it |
|---|---|---|
| One stored value | 10 MB | Shrink the value, for example by trimming old entries. See Data storage. |
| One file | 10 MB | Shrink or split the file. See Data storage. |
| Files per app | 50 | Delete a file you no longer need. See Data storage. |
| All files in an app, combined | 100 MB | Delete a file you no longer need. See Data storage. |
Contact us if any of these are too small for what you’re building.
Secrets
| What | Cap | What to do when you hit it |
|---|---|---|
| One secret value | 8 KiB (KiB = 1,024 bytes) | Real API keys are far below this cap; hitting it usually means you’re storing data, not a key. Use Data storage for data. See Secrets. |
Network access
Your app’s backend can’t make outbound requests until it declares that it needs to, and even then only to public web addresses over HTTPS. Private networks, localhost, and cloud provider metadata services (internal addresses that can leak credentials) stay blocked, whether the app calls them directly or gets redirected there. You can narrow this further to a specific list of hosts; see Secrets for how an agent sets that up.
A sealed fetch, the kind that fills in a secret for you, cuts a response off at 5 MB.
Building and updating apps
| What | Cap | What to do when you hit it |
|---|---|---|
| App module code | 256 KiB | Split logic across operations, or trim what you send. |
| App UI code | 256 KiB | Same as above. |
| App description | 500 characters | Shorten it; it’s a search-friendly label, not the full pitch. |
| Starter prompt | 2000 characters | Trim it to the essentials. |
Accounts and tokens
| What | Default | Notes |
|---|---|---|
| An anonymous app | Kept 7 days | Sign in and claim it to keep it indefinitely. |
| A personal access token you mint by signing in | 7 days | Mint a new one when it expires. |
| A token from device pairing | 30 days | Approve pairing again when it expires. |
See Connect to any AI agent for how these tokens work.
Fair use
One account can have any number of apps. Listing apps returns 50 per page by default, up to 100 if you ask for more, with paging past that.
Uploading a file from inside a running app is rate-limited per visitor and per app, on top of the 100 MB per-app total above, so one busy app or a single visitor can’t crowd out everyone else.
Most of these can move if what you’re building needs more. Contact us and tell us about it.
Related
- Data storage
- Secrets
- Connect to any AI agent
- build-mcp.md / build-http.md: how an agent declares network access in the manifest.
- pricing.md: the same numbers as a machine-readable table, plus rate-limit details.
- Docs home