Plan limits
This is the canonical reference for TokenTimer Cloud plan limits. Prices and plan selection are on the Pricing page.
Core limits
| Limit | Free | Pro | Team |
|---|---|---|---|
| Tokens | 25 per workspace | 500 per organization | 5,000 per organization |
| Workspaces | 1 | 10 | Unlimited |
| Members per organization | 1 | 10 | Unlimited |
| Alert deliveries per month | 30 | 1,000 | 10,000 |
Alert delivery counters reset monthly (UTC, first day of the month). You are warned at 80% of a limit.
On the Free plan the token cap applies per workspace; on Pro and Team it applies across your whole organization (all workspaces you own combined).
Alerting and channels
Channel and recipient limits. See Alerts & thresholds and Contact groups & channels for how these features work.
| Limit | Free | Pro | Team |
|---|---|---|---|
| Email alerts | Yes | Yes | Yes |
| Webhooks (Slack, Teams, Discord, PagerDuty, generic) | No | Yes (5 per workspace) | Yes (5 per workspace) |
| WhatsApp alerts per month (per organization) | 30 | 400 | 1,200 |
| WhatsApp per-minute throttle (per organization) | 10/min | 60/min | 180/min |
| Contact groups per workspace | 3 | Unlimited | Unlimited |
| Members per contact group | 1 | 3 | 10 |
| Weekly digest | No | Yes | Yes |
Integrations and discovery
Automatic credential discovery via integrations (Vault, GitHub, GitLab, AWS, Azure, GCP) and the Domain Checker (subdomain discovery and bulk certificate import).
| Limit | Free | Pro | Team |
|---|---|---|---|
| Integration scans per workspace per month | 3 | Unlimited | Unlimited |
| Domain Checker lookup allowance (lifetime, per account) | 2 | Unlimited | Unlimited |
| Domain Checker discovery results per lookup | 25 | 500 | 5,000 |
| Domain Checker certificate imports | Not available | 500 | 5,000 |
The lookup allowance is lifetime, not monthly: a Free account gets 2 lookups total, ever, not 2 per month. Pro and Team accounts never consume this allowance since every lookup they run is unlimited from the start. Discovery results per lookup is a separate cap on how many subdomains a single lookup can return; the lookup allowance is a separate cap on how many lookups a Free account can run at all.
Certificates (CertOps)
CertOps is the managed certificate operations layer; machine API tokens authenticate your renewal scripts against it. See Certificates.
| Limit | Free | Pro | Team |
|---|---|---|---|
| Active managed certificate slots per workspace | 0 | 25 | 250 |
| Machine API tokens and executor API | No | Yes | Yes |
| Endpoint SSL monitoring (ssl_cert tokens) | Yes | Yes | Yes |
| Self-hosted agents per workspace | 0 | 5 | 25 |
| Self-hosted cert-manager controllers per workspace | 0 | 5 | 25 |
| Renewal jobs per workspace per month (metered) | 0 | 500 | 5,000 |
| Active trust anchors per workspace | 0 | 5 | 25 |
Only active managed certificates count toward the slot limit; retiring a certificate to revoked or decommissioned frees its slot. See Certificates.
Agents and self-hosted controllers are each their own dedicated counter, independent of each other and of the managed-certificate slot limit above: registering an agent does not consume a controller slot or a certificate slot, and vice versa. Only active registrations count toward either limit; retiring an agent or removing a controller's tokens frees its slot the same way retiring a certificate frees a slot. The controller is not a hosted TokenTimer Cloud component: run core's published open-source image, ghcr.io/tokentimerch/tokentimer-core-k8s-controller, in your own Kubernetes cluster, configured to report into Cloud.
The renewal-job quota is a monthly count per workspace that resets on the first day of the month (UTC), the same pattern as the alert-delivery counters above. Free is 0 because a renewal job requires a registered agent, and Free does not support agent registration. Renewal profiles themselves are not metered: a profile is a derived artifact attached to a managed certificate that already counts toward the slot limit above, so it does not consume a limit of its own.
Trust anchors are the CA certificates an agent distributes to or revokes from a device's OS/browser trust store; only active anchors count toward the limit, and retiring one frees its slot. Distributing or revoking a trust anchor requires a registered agent, so Free (which does not support agent registration) has no trust-anchor capacity.
Audit
The audit log records security-relevant actions and alert delivery outcomes.
| Limit | Free | Pro | Team |
|---|---|---|---|
| Audit log access | No (events are still recorded) | Yes | Yes |
| Audit retention | - | 90 days | 1 year |
| Audit export (CSV/JSON) | No | Yes | Yes |
What happens at a limit
- Creations are blocked: reaching a cap (for example the token limit) blocks new creations until you upgrade or clean up. The API returns a limit error; the dashboard shows the limit state.
- Alert deliveries stop: when the monthly delivery cap is reached, further alerts are blocked for the month and recorded as
ALERT_BLOCKED_PLAN_LIMITaudit events. Delivery resumes on the next monthly reset. - Pending invitations count: the member limit check is
active_members + pending_invitations + 1 <= limit. Cancel stale invitations to free slots. See Teams. - Downgrades: see Billing & plans for how limits are applied when moving to a smaller plan.