Rate limits on GitLab.com are changing

Your automation scripts may hit new rate limits if they are unauthenticated, requiring you to add authentication to keep them running.

GitLab.com is implementing new rate limits on October 19, 2026, that will align with user subscription tiers. Free accounts and unauthenticated requests will be subject to stricter limits initially, with Premium and Ultimate tiers seeing changes in January 2027. The aim is to maintain platform speed and reliability as demand increases. Unauthenticated requests will be limited to 60 per hour per IP address. Authenticated requests will follow plan-specific limits, which are generally much higher. GitLab has provided preview windows in early October to allow users to test their workloads against the new limits before they are enforced. Users nearing limits are advised to authenticate their requests, batch API calls, or consider upgrading their subscription. GitLab is also exploring options for purchasing additional capacity beyond standard plan limits for specific needs.

These changes signal GitLab's proactive approach to managing platform scalability and ensuring a consistent user experience as its user base and workload demands grow. By segmenting limits based on subscription tiers, GitLab incentivizes upgrades for users requiring higher API access while ensuring basic functionality remains accessible to free users. This tiered approach is becoming a standard for SaaS platforms managing API access, balancing resource allocation with revenue generation. The inclusion of preview windows indicates a user-centric approach to enforcing these changes, allowing developers to adapt their workflows before the new limits become mandatory.

Developers relying on unauthenticated API access, particularly for automation or public projects, will need to adapt by either authenticating their requests using personal access tokens or CI/CD job tokens, or by optimizing their API interaction patterns. This shift could impact integrations that were previously assumed to have unlimited access, potentially requiring refactoring or subscription upgrades. GitLab's acknowledgment of legitimate anonymous patterns and offering direct contact for complex cases suggests a willingness to accommodate edge cases, but the primary expectation is for users to authenticate for higher limits.