Rate limits and quotas on corsproxy.dev, explained
If you got a 429 from corsproxy.dev, this page covers what counts against your daily request and bandwidth quotas, when they reset, how the counter is enforced, and what happens when you hit the limit.
What counts as a request
Every authenticated call to /proxy (or /v1/proxy) that gets past the checks below counts once, whatever the upstream returns. An upstream 500 and a clean 200 count the same: the meter runs on your request, not on whether the target liked it.
Requests rejected before counting don't use quota:
- a missing or malformed target URL;
- a missing or invalid API key;
- a target the key isn't allowed to call (
TARGET_NOT_ALLOWED); - a blocked private or unsafe target (
BLOCKED_HOST,UNSAFE_TARGET); - an account that hasn't accepted the terms yet.
Requests to account endpoints (/v1/auth/*, /v1/api-keys/*, /v1/usage/*) don't count against your proxy quota. Only actual proxying does.
The daily bandwidth cap
There's a second daily limit on data transferred: 250 MB on Free and 10 GB on Pro. Going over it returns a 429 with the code BANDWIDTH_LIMIT_EXCEEDED. The bandwidth check runs after the request has been counted, so a request rejected for bandwidth still uses one unit of request quota. The bandwidth total is eventually consistent, so it can run slightly past the cap before requests start being refused.
How the limit is enforced
Your account's daily request count lives in a Cloudflare Durable Object, one counter per account, checked and incremented atomically on every request. That serializes concurrent requests, so on Free the 500th request lands right on the limit and the 501st gets a 429, even under load; KV vs D1 vs Durable Objects explains why a plain read-check-write counter can't guarantee that.
Historical usage (the numbers behind your dashboard charts) is a separate, non-authoritative record in D1. It's what you see in Usage → History; it is not what gates your requests.
What a 429 looks like
HTTP/1.1 429 Too Many Requests
{
"success": false,
"error": "Rate limit exceeded. Your limit is 500 requests per day. Resets at Tue, 18 Aug 2026 00:00:00 GMT",
"code": "RATE_LIMIT_EXCEEDED"
}Successful proxy responses carry X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, and X-RateLimit-Reset (Unix seconds), so you can slow down before you hit the wall. There is no Retry-After header; use X-RateLimit-Reset to schedule retries.
The counter resets at 00:00 UTC, not on a rolling 24-hour window. If you use up your quota at 11pm UTC, you get it back an hour later.
Limits by plan
- Free: 500 requests and 250 MB per day.
- Pro ($5/month): 20,000 requests and 10 GB per day.
- Enterprise: unlimited, pricing on request.
The request quota is per account and shared across all its keys. Every plan goes through the same enforcement path; paid plans just have a higher number. See the API docs for current figures.
If you're building something that needs more
You can upgrade to Pro, ask for a higher limit (email contact@corsproxy.dev), or self-host. The open-source Go proxy is a separate, simpler relay, not the code behind corsproxy.dev: it has no accounts and no daily quota, only an optional per-IP per-minute rate limit that's off by default.
What happens when you hit the limit
You get a 429 until the counter resets, for every key on the account, since they share one quota. We also email you, and the admin is notified. Your key isn't banned or disabled. If you're seeing 429s you don't expect, check Usage → History in the dashboard first; a client-side retry loop quietly multiplying real traffic is a common cause.