Limits and capacity
The limits and lifetimes of the running service, and the capacity number we do not have.
We publish no capacity number
Each account has its own realm. A realm is a separate sign-in space in the sign-in service. The number of realms equals the number of accounts.
We have never load-tested how many realms one instance can hold. We publish no capacity number. See Accounts and isolation for the realm design.
One instance
RealmSSO runs one API instance and one sign-in service instance, on one machine. There is no standby. See How we run your instance.
This page lists only limits that we can show. It lists no throughput figure and no latency figure.
Limits of the running service
The Basis column says how we know each value. We measured two values on production. The other values come from settings in the server or from our deployment records.
| Limit | Value | Basis |
|---|---|---|
| Realms in one instance | No number. | Never load-tested. |
| API requests | 200 requests per window for each client address. The server counts them in its own memory. | We measured the limit on 2026-10-03. The window is 60 seconds, the default in our deployment settings. We did not measure the window. |
| Webhook test route | 5 calls per 60 seconds for each webhook and client address. Then the API answers 429. | Set in the server. |
| Webhook delivery | A delivery pass runs every 5 seconds. A delivery gets 3 attempts. The wait before the second attempt is at least 5 seconds, and before the third at least 10 seconds. Each attempt times out after 10 seconds. After the third failed attempt, the delivery becomes a dead letter. | We measured the 5-second pass on production on 2026-09-14. The other values are server defaults. |
| Webhook delivery records | Kept 90 days. You can redeliver a delivery for 90 days. | Default. We did not measure the production value. |
| Observability events | Kept 90 days by default. | Default. We did not measure the production value. |
| Page size | SCIM list: at most 200 results. Audit log: up to 200 rows per page. Event feed: up to 200 events per page. | Set in the server. |
| Sign-in link for a dashboard user | Valid 15 minutes. Single use. Only the newest link works. | Set in the server. |
| Invite link for an IT admin | Valid 30 minutes. Single use. The Admin Portal session ends 30 minutes after RealmSSO made the link. | Set in the server. |
| Dashboard session | A 24-hour token and a 30-day refresh token. Each use of the refresh token issues a new one. | Set in the server. |
| Instances | One API instance and one sign-in service instance, on one machine. | Our deployment records, read 2026-10-03. |
Where to read more
Webhooks API describes delivery, retry and the dead letter. SCIM directory sync describes the list routes. Monitoring and health describes events and their retention.