GitLab.com rate limits unauthenticated API calls to 60 an hour, today
Free-tier and anonymous requests to GitLab.com now hit a 60-per-hour cap, with Premium and Ultimate following in January. Unauthenticated scripts get a 429.
GitLab.com rate limits now align with subscription tier, starting today. Any request with no credentials gets 60 requests an hour per IP address. Free-tier limits take effect today, 19 October, with Premium and Ultimate following in January 2027. GitLab ran two preview “brownout” windows on 7 and 14 October so teams could see the new limits in effect before they stuck.
GitLab says the change is about load, not AI specifically, though it names the cause: “the automation and agent workloads teams are building on the platform” are pushing traffic up several times over this year. The change is GitLab.com only, GitLab says: Self-Managed and Dedicated limits stay with whoever runs that instance.
Anything hitting the GitLab.com API without a token, a scraper, an unauthenticated webhook check, a CI job calling out anonymously, will start seeing 429 responses once it crosses 60 calls an hour. GitLab’s own fix is to authenticate: a personal access token, OAuth token or CI/CD job token moves a client off the anonymous cap and onto the much higher per-plan limits published in its rate limits docs.
Why it matters: if you’ve got a script, bot or CI step that talks to the GitLab.com API without logging in, today is when it starts breaking rather than just being slow. Add a token and handle 429 with backoff before it does.