Plan limits
This is the canonical reference for TokenTimer Cloud plan limits. Prices and plan selection are on the Pricing page.
Core limits
| Limit | Free | Pro | Team |
|---|---|---|---|
| Tokens | 25 per workspace | 500 per organization | 5,000 per organization |
| Workspaces | 1 | 10 | Unlimited |
| Members per organization | 1 | 10 | Unlimited |
| Alert deliveries per month | 30 | 1,000 | 10,000 |
Alert delivery counters reset monthly (UTC, first day of the month). You are warned at 80% of a limit.
On the Free plan the token cap applies per workspace; on Pro and Team it applies across your whole organization (all workspaces you own combined).
Alerting and channels
Channel and recipient limits. See Expiry reminders and thresholds and Contact groups & channels for how these features work.
| Limit | Free | Pro | Team |
|---|---|---|---|
| Email alerts | Yes | Yes | Yes |
| Webhooks (Slack, Teams, Discord, PagerDuty, generic) | No | Yes (5 per workspace) | Yes (5 per workspace) |
| WhatsApp alerts per month (per organization) | 30 | 400 | 1,200 |
| WhatsApp per-minute throttle (per organization) | 10/min | 60/min | 180/min |
| Contact groups per workspace | 3 | Unlimited | Unlimited |
| Members per contact group | 1 | 3 | 10 |
| Weekly digest | No | Yes | Yes |
Integrations and discovery
Automatic credential discovery via integrations (Vault, GitHub, GitLab, AWS, Azure, GCP) and the Domain Checker (subdomain discovery and bulk certificate import).
| Limit | Free | Pro | Team |
|---|---|---|---|
| Integration scans per workspace per month | 3 | Unlimited | Unlimited |
| Domain Checker lookup allowance (lifetime, per account) | 2 | Unlimited | Unlimited |
| Domain Checker discovery results per lookup | 25 | 500 | 5,000 |
| Domain Checker certificate imports | Not available | 500 | 5,000 |
The lookup allowance is lifetime, not monthly: a Free account gets 2 lookups total, ever, not 2 per month. Pro and Team accounts never consume this allowance since every lookup they run is unlimited from the start. Discovery results per lookup is a separate cap on how many subdomains a single lookup can return; the lookup allowance is a separate cap on how many lookups a Free account can run at all.
Certificates (CertOps)
CertOps is the managed certificate operations layer; machine API tokens authenticate your renewal scripts against it. See Certificates.
| Limit | Free | Pro | Team |
|---|---|---|---|
| Active managed certificate slots per workspace | 0 | 25 | 250 |
| Machine API tokens and executor API | No | Yes | Yes |
| Endpoint SSL monitoring (ssl_cert tokens) | Yes | Yes | Yes |
| Self-hosted agents per workspace | 0 | 5 | 25 |
| Self-hosted cert-manager controllers per workspace | 0 | 5 | 25 |
| Renewal jobs per workspace per month (metered) | 0 | 500 | 5,000 |
| Active trust anchors per workspace | 0 | 5 | 25 |
Each distinct fingerprint with an open management period counts once; managed fingerprintless records count separately. Revoked or decommissioned lifecycle does not free quota. Closing the final management period releases the fingerprint’s slot. Existing-source rotation can temporarily exceed quota; additional enrollment is blocked only if it increases usage. See Certificates.
Agents and self-hosted controllers are each their own dedicated counter, independent of each other and of the managed-certificate slot limit above: registering an agent does not consume a controller slot or a certificate slot, and vice versa. Only active registrations count toward either limit; retiring an agent or removing a controller's tokens frees its slot independently of certificate lifecycle. The controller is not a hosted TokenTimer Cloud component: run core's published open-source image, ghcr.io/tokentimerch/tokentimer-core-k8s-controller, in your own Kubernetes cluster, configured to report into Cloud.
The renewal-job quota is a monthly count per workspace that resets on the first day of the month (UTC), the same pattern as the alert-delivery counters above. Free is 0 because a renewal job requires a registered agent, and Free does not support agent registration. Renewal profiles themselves are not metered: a profile is a derived artifact attached to a managed certificate that already counts toward the slot limit above, so it does not consume a limit of its own.
Trust anchors are the CA certificates an agent distributes to or revokes from a device's OS/browser trust store; only active anchors count toward the limit, and retiring one frees its slot. Distributing or revoking a trust anchor requires a registered agent, so Free (which does not support agent registration) has no trust-anchor capacity.
Audit
The audit log records security-relevant actions and alert delivery outcomes.
| Limit | Free | Pro | Team |
|---|---|---|---|
| Audit log access | No (events are still recorded) | Yes | Yes |
| Audit retention | - | 90 days | 1 year |
| Audit export (CSV/JSON) | No | Yes | Yes |
What happens at a limit
- Creations are blocked: reaching a cap (for example the token limit) blocks new creations until you upgrade or clean up. The API returns a limit error; the dashboard shows the limit state.
- Alert deliveries stop: when the monthly delivery cap is reached, further alerts are blocked for the month and recorded as
ALERT_BLOCKED_PLAN_LIMITaudit events. Delivery resumes on the next monthly reset. - Pending invitations count: the member limit counts distinct active members and distinct pending emails across the organization. An email already represented there does not consume an additional slot. Cancel stale invitations to free slots. See Teams.
- Downgrades: see Billing & plans for how limits are applied when moving to a smaller plan.