Introduction

Limitations

xgoose.org is a free service backed by paid AI providers, so there are some guard-rails. Most you will never hit. The ones you will hit are documented here.

AI quotas

Every call to POST /ai/v1/chat/completions consumes tokens from a rolling 24-hour bucket attached to your account. The bucket size depends on your tier:

Tier	Default daily limit	How you get it
`anon`	0 tokens	Anyone signed out. Cannot use the gateway.
`verified`	100,000 tokens	Sign in with a verified email.
`attested`	500,000 tokens	Genuine extension install proven via Apple App Attest (sent automatically by the Safari build).

The window starts when you make your first call after a reset; on depletion the gateway returns 429 Too Many Requests with a retry_after field. Defaults can be changed per-deployment, and an admin can reset your bucket — but only as a stop-gap, not a permanent answer. For sustained heavier use, bring your own key and we will route directly to your upstream provider with no quota at all.

Per-minute rate limit

Independently of the daily quota, the gateway enforces 20 requests per minute per user. Exceeding it returns 429 with {"window": "minute"}. The window is wall-clock minute aligned, not sliding, so a burst right at the boundary will succeed.

Prompt size

The combined byte length of every messages[].content in a single request is capped at 32 KB. Long agent transcripts usually fit, but a single user message pasted from a PDF may not — split them up.

Model whitelist

The gateway exposes a static list of models, fetched from the underlying LiteLLM proxy and cached for five minutes. Any model id not on the list is rejected with 403. You can read the current list from GET /ai/v1/models; see AI gateway for details. We rotate models in and out — usually adding, occasionally retiring — so don't hard-code an id in a skill if you can help it.

Account constraints

Email verification is mandatory. Password and magic link signups don't issue a session until you click the link in the email. GitHub OAuth skips the round-trip only when the upstream explicitly returns email_verified: true.
Magic links expire in 10 minutes and can only be used once. Request a fresh one if it goes stale.
Device codes for the extension pairing flow also expire in 10 minutes, poll at 5-second minimum intervals.

Skill registry

Single-file artifacts only. The uploader bundles your defineSkill body to an IIFE in the browser before upload — see the authoring reference.
Source files are limited to 256 KB, bundled output to 512 KB, and the optional README @description body to 64 KB.
Slug ownership is first-come, first-served. Re-publishing under a slug you own auto-bumps the patch component if you forget to bump @version.
The registry is not a sandbox. Skills run with full page-level privileges inside the extension; treat the install banner's per-function summary as the source of truth before you click confirm.

Browser support

The Safari Web Extension is the reference build (with Apple App Attest for the elevated tier). Chrome and Firefox builds share the same skill format and registry but currently land in the verified tier.