# Plans and limits

> Monthly active users, what happens above a plan's limit, rate limits and the other numbers worth knowing.

Source: https://9in.io/docs/reference/limits/

## Plans

| | Free | Pro | Business | Enterprise |
|---|---|---|---|---|
| Price | $0 | $35/month ($29 billed yearly) | $240/month ($199 billed yearly) | Contact sales |
| Monthly active users (shared by all production tenants) | 7,500 | 25,000 | 100,000 | Custom |
| Above the limit | New sign-ups pause at 110% | $2 per 1,000 extra | $1.50 per 1,000 extra | In the contract |
| Tenants | 2 | 5 | 20 | Unlimited |
| Custom domains | 1 | 3 | 10 | Unlimited |
| Enterprise SSO connections | – | 1 | 10 | Unlimited |
| SMS through 9in | – (your own Twilio) | Yes, up to 1,000/day per tenant | Yes, up to 10,000/day per tenant | Yes |
| Activity log kept | 7 days | 30 days | 90 days | 1 year |

Current prices: [9in.io/pricing](https://9in.io/pricing).

## Monthly active users

A user is **active** in a month when they sign in at least once that month (with any method), in a **production** tenant. Refreshing tokens doesn't count as a new sign-in. Sandbox users never count. Users are counted across all of an account's production tenants.

Above the included users, paid plans keep working and bill the extra users. The Free plan pauses **new sign-ups** at 110% of its limit (`signups_paused`); everyone who already has an account keeps signing in. Nobody with an account is ever refused because of a limit.

## Technical limits

| What | Limit |
|---|---|
| Applications per tenant | 200 |
| APIs per tenant | 50 |
| Scopes per tenant | 100 |
| Enterprise connections per tenant | 50 (and your plan's limit) |
| Webhook endpoints | 20 per tenant |
| Signing keys | 20 per tenant |
| Users per import request | 500 (50 with plain-text passwords) |
| Management API list page | 1 to 200 users |
| Login link lifetime | 1 minute to 1 hour |
| Uploaded files | 2 MB each, 100 per tenant |
| Theme templates | 60 files, 256 KB each, 2 MB total |
| Adapter call timeout | 0.5 to 10 seconds (default 3) |
| Webhook response time | 10 seconds; retried over about a day |
| Failed sign-ins before lockout | 3 to 100 (default 10), locked 1 minute to 24 hours (default 15 minutes) |
| One-time codes | 6 to 8 digits, valid 1 to 60 minutes, 1 to 10 attempts |

Sign-in pages and the token endpoint run on Cloudflare's global network. Abuse is limited per account and IP address (see [Sessions and security](https://9in.io/docs/security/)).