GitLab.com slashes unauthenticated API to 60 requests an hour
Oct 19 hits Free and anonymous traffic first; authenticate to jump from 60 to 5,000 requests an hour, and test during the Oct 7 and 14 brownouts.
Copy markdown
Anonymous traffic falls off a cliff
From October 19, unauthenticated requests to GitLab.com are capped at 60 per hour per IP address. Any script, scraper, or CI step that hits the GitLab API or clones over HTTPS without a token will start collecting 429s fast.
The fix is one token away
Attach a personal access token, OAuth token, or CI/CD job token ($CI_JOB_TOKEN) and you jump to the Free tier's 5,000 requests/hour with a 100/minute burst — 83x more headroom, at zero cost. Audit your .gitlab-ci.yml for bare curl calls missing the token.
Free now, paid tiers in January
The Oct 19 cutover only touches Free accounts and anonymous IPs. Premium (15,000/hour) and Ultimate (25,000/hour) limits don't land until January 2027, and every limit applies per user and per top-level group. Self-managed instances are untouched.
Two brownouts to stress-test first
GitLab is previewing the new caps during brownout windows on Oct 7 and Oct 14, 15:00-19:00 UTC. Run your pipelines in those windows to surface breakage early, and wire in Retry-After handling with exponential backoff before the permanent switch.