GitLab.com Ties API Rate Limits to Your Subscription Plan

GitLab just announced it's tying API rate limits on GitLab.com to subscription tier. If any automation or integration is calling the API without authentication, next month is when it starts to matter.

What's happening

Per the official blog post published September 17, 2026, GitLab.com's traffic is growing fast enough that the infrastructure team needs predictable ceilings — one runaway workload shouldn't be able to slow the platform for everyone else. The fix: split rate limits by tier — Free, Premium, Ultimate — applied per user and per top-level group.

Rollout happens in two waves:

• October 19, 2026: new limits apply to Free accounts and all unauthenticated requests
• January 2027: new limits apply to Premium and Ultimate

Any request that shows up with no credentials — even one made under a paid account — gets capped at 60 requests per hour per IP address. That's the detail worth catching early: a CI job or background bot that forgets to attach a token still counts as anonymous, regardless of the plan behind it.

So what does this mean for developers?

GitLab is running two preview windows — short "brownouts" that flip the new limits on and back off — on October 7 and October 14, from 15:00 to 19:00 UTC. Nothing else about the service changes during those windows; it's purely a chance to see how a real workload behaves under the new ceiling before October 19 makes it permanent.

Hit the limit and the response comes back HTTP 429 with a Retry-After header. A client that reads that header and backs off will mostly recover on its own — but retrying immediately, or polling in a tight loop, is the fastest way to burn through the allowance.

Three things worth doing before October 19:

• Authenticate every request. A personal access token, OAuth token, or CI/CD job token all move a request off the 60/hour anonymous bucket and onto the much higher plan-based limit
• Batch and cache. Tight polling loops are the most common reason automation hits a limit before real users ever do
• Watch the RateLimit-Remaining header on responses to know how much allowance is left in the current window

What stays the same

GitLab is explicit that this only touches GitLab.com, the SaaS product. GitLab Self-Managed and GitLab Dedicated are untouched — those limits stay with whoever operates the instance. Access to and export of your own data and repositories also isn't restricted further.

For a busy public project pulling anonymous traffic, GitLab suggests three options. Have the calling automation sign in. Make the project private if the traffic isn't coming from the audience it was built for. Or upgrade to Premium/Ultimate for materially higher ceilings. There's also a plan to sell extra capacity above the standard tier limits, with details expected later this year.

One thing stands out: GitLab describes the Free-tier limit as matching "industry norms," while Premium and Ultimate sit at levels other platforms usually reserve for enterprise contracts or don't publish at all. In other words, this isn't purely a tightening — for anyone already paying, the ceiling is actually more generous than the market average.

Takeaways

• New limits land October 19, 2026 (Free + anonymous) and January 2027 (Premium/Ultimate)
• Unauthenticated requests drop to 60/hour per IP, even from paid accounts
• Two preview windows — October 7 and 14 (15:00-19:00 UTC) — to test ahead of time
• HTTP 429 + Retry-After on limit breach; clients that back off recover cleanly
• Only GitLab.com is affected — Self-Managed and Dedicated are unchanged

Tying rate limits to subscription isn't a GitLab-only move — it's the direction most DevOps platforms are heading as they absorb more traffic from agents and automation calling APIs continuously, not just humans clicking around. Anyone still running an integration anonymously should treat this as the nudge: authenticating requests is no longer optional.

---

Content assisted by AI (Amy 🌸). Reviewed by the author.