# Limits and FAQ

## Limits

envpass is free. These limits keep it fast for everyone:

| Resource | Limit |
|---|---|
| Workspaces you own | 3 |
| Projects per workspace | 10 |
| Environments per workspace | 10 |
| Members per workspace | 25 |
| Roles per workspace | 30 |
| Service tokens per workspace | 50 |
| Webhooks per workspace | 10 |
| Vercel and GitHub connections per workspace | 10 |
| Syncs per project | 20 |
| Keys per project | 500 |
| Value size | 32 KB |
| API requests | 300 per minute per token (30 resolves) |
| Share links | 20 per user per day |
| Invitations | 20 per workspace per day |

Current usage is shown under **Usage** in each workspace. Hitting a limit returns HTTP 403 with code `limit_reached` and the limit's name.

## FAQ

### Can envpass read my secrets?

Values are encrypted at rest and decrypted on the server only to answer a request from someone with access, or to push them to Vercel or GitHub for a [sync](/docs/syncs) you set up. That is what lets CI and your team pull them. Share links are encrypted in the browser and the server never has their key. See [Security](/docs/security).

### Can I export everything?

Yes. Export any environment as `.env`, JSON or shell exports from the app, the CLI (`envpass pull`) or the API.

### How do I rotate a value?

Write the new value. The old one stays in the version history, and you can restore it if the rotation breaks something. Syncs push the new value within seconds; Vercel uses it from the next deployment.

### What happens when someone leaves?

Remove them under **Members**. Their access and the service tokens they created stop working immediately, and the audit log shows what they accessed. Syncs they set up stop with an error until someone else sets them up again.

### What happened to services?

Projects used to have services (for example `api` and `web`), each able to override the project's Shared values. Services were removed: a project now holds one set of values per environment, plus personal overrides. If two apps need different values for the same key, give each its own project.

Existing data was converted like this:

- For each key in each environment, the project-wide value was kept. If there was none, the most recently updated service value became the project's value.
- Every other service value was moved to **Recently deleted** for that environment, where it can be restored for 30 days. A key can only be restored when no live key has the same name, so rename or delete that one first.
- Service tokens scoped to a single service were revoked, since they would otherwise read the whole project. Create new ones under **Project → Tokens**.
- Personal overrides were not changed. The **Manage services** permission was removed from every role.

Upgrade the CLI and clients to 0.2 or later. They no longer have `-s/--service` or `ENVPASS_SERVICE`, and they ignore a `service` field in `.envpass.json`. The API ignores a `service` parameter on `resolve`, so an older client that still sends one gets the project's values.

### Is there a CLI?

Yes: `bunx envpass-cli`, `npx envpass-cli` or `uvx envpass-cli`. See [CLI](/docs/cli).