# Sign-in and chat request limits

Limit repeated sign-in attempts, verification-code requests and selected rapid chat actions.

*Release 3.3 · admin, operator, visitor*

**Settings › Account › Operators**

## What it is

INSIDE has separate limits for repeated sign-in failures, email verification and selected rapid chat requests. Each limit has its own scope and recovery action. A brief chat-request wait does not mean your operator account is locked.

## Who uses it and why

Operators follow the sign-in, code and retry messages when a limit is reached. Administrators arrange account unlocking and ask Powerfront to investigate repeated rejections. Visitors can also encounter the request limit on the affected realtime chat action.

## Where to find it

Messages appear during the affected sign-in, verification or chat action. There is no combined Settings screen for these limits.

Account administrators with the **Settings** or **Manager** role use **Settings › Account › Operators** when an operator account needs unlocking.

## How it works

- Six failed sign-in attempts trigger operator account lockout. Incorrect supplied second-factor codes can also count towards this threshold.
- Email second-factor requests have a 60-second resend interval. Five failed email-code checks clear the outstanding code, requiring a new one. The sign-in lockout can also apply.
- Protected export verification allows three incorrect checks before setting its export lock state. History and report code requests check a one-hour lock; the personal-data code-request flow differs.
- The standard realtime chat-send action normally accepts up to ten requests within a rolling ten-second window on a connection. The next request is rejected with **Rate limit exceeded. Please try again in a moment.** Powerfront can change this maximum.

## Configure it

There are no client Settings controls for these thresholds. Ask Powerfront to investigate recurring rate-limit errors, including the action and time of the failure.

For an operator lockout, ask your **Settings** or **Manager** account administrator to review the account under **Settings › Account › Operators**. Unlocking an account is separate from waiting for a chat-request window or export lock to pass.

## Limits and good to know

- The chat request guard covers the standard realtime send action, not every message-sending path, chat event, browser request or integration call.
- Its count follows a connection. It is not a website-wide message allowance or a guaranteed cross-connection abuse limit.
- The sign-in, email-code and export counters are independent. Clearing one does not establish that the others are clear.
- Personal-data export requests do not enforce the same lock check as history and report code requests.
- These product limits do not define a general requests-per-second contract for all INSIDE traffic.

## Depends on and works with

### This feature uses

- **Configured in** [Operator accounts](ADM-007.md): Authorised account managers can unlock locked operator accounts.
- **Related** [Messages and rich content](CHAT-002.md): Rapid standard realtime chat sends can reach a short request limit without locking an operator account.
- **Related** [Login and email verification](SEC-001.md): Repeated failed sign-ins can lock an account and require an authorised account manager to unlock it.
- **Related** [Two-factor authentication for operator sign-in](SEC-003.md): Email second-factor codes have resend and failed-verification limits alongside sign-in lockout.
- **Related** [Email verification for protected exports](SEC-013.md): Protected exports have their own verification-attempt limits, separate from sign-in and chat limits.

### Used by

- **Related** [Login and email verification](SEC-001.md): Repeated failed password or second-factor checks can lock your operator account.
- **Related** [Two-factor authentication for operator sign-in](SEC-003.md): Incorrect supplied codes can count towards sign-in lockout, and email codes have separate retry limits.

## FAQ and troubleshooting

### What should I do after a chat rate-limit message?

Pause for the short request window to pass, then retry. Check whether the action succeeded before submitting it again. If the error recurs during ordinary use, ask Powerfront to investigate.

### Will waiting ten seconds unlock my operator account?

No. Account lockout follows failed sign-ins and requires the account-unlock process.

### Why can I not request another email code yet?

Wait for the 60-second resend interval. Use the latest code received.

### Why did an email code stop working after several attempts?

Five failed checks clear the outstanding email code. Request a new one after the resend interval; if your account is locked, have it unlocked first.

### Does the chat limit describe our public API allowance?

No. It covers one selected realtime chat action and does not establish a general API quota.