Apologies for sending so many questions. But does calls to /sessions/whoami counts as permission checks for pricing purposes?

no!

That's good to hear!

Oh, it is only the login that counts? I have been wondering this same topic. More specifically if I use Ory to secure webapp’s UI and API calls I can throw in as many

whoami

calls I like? One thing that I have been worrying after reading some previous discussions about burst limits • 40 requests per second • 900 requests per minute What if all of my webapp’s page loads will check the session, and all of the API calls make the same check? With even one hundred users it might go easily over 900

whoami

requests per minute. In a simplified example: if the UI calls couple of API endpoints on each page load (both of them verifying the session), and UI itself does a request too. Each page load would cause three requests to

whoami

. If a hundred users are doing three page loads in a one minute timeframe we cap the 900 limit. And the Essentials plan is said to be for 1000 DAU. I hope that I have got something wrong about the limits 😀 @high-optician-2097

We have much different limits on whoami calls :) not sure if we limit it at all tbh

@high-optician-2097 I pinged you on a thread where @stocky-king-5626 said it quite clearly. I just find it hard to understand how Essentials plan is said to be for up to 1000 DAU and still have so tight limits for whoami requests :) Like I gave you an example I can’t see how those limits (40 req/s, and 900 req/min) would be enough for securing pretty traditional webapp+backend for 1000 users. I might understand all wrong and I am happy to be corrected :)

Hey Toni, these limits are mostly there to protect the system, not punish customers. We will increase rate limits as we go and it’s our priority that our customers serve their users well tooY If you run into lots of rate limits, we’ll address the issues!

@high-optician-2097 Thanks for sharing! I totally understand protecting the system, and I am glad to hear that these are not set in stone. I really like the Ory Network as a service. I am just a bit worried if we might hit a wall with the current plan while developing our system. It is of course pretty easy to do some tests by simulating more traffic, and see how it works when there will be more users.

If you hit troubles in terms of usage, you’re always one slack message away from the founder(s) of the company :)