Limits and defaults

Verified against v0.10.0 · internal/db/migrations, internal/hub/hub.go, internal/db/db.go, internal/api/passcode.go, internal/api/router.go, cmd/parley/main.go, internal/store/presence.go

Everything numeric, transcribed from source. None of these is configurable unless the page says so. The environment variables named below accept positive integers and are validated at boot.

Field lengths

User name	1–64	Characters, not bytes; also caps a name derived from an IdP claim
Space name	1–64	Characters, not bytes
Space slug	1–64	Lowercase, URL-safe pattern, unique
Passcode	6	Column allows 12; the generator makes 6
Session title	1–200	Characters, not bytes
Story title	1–200
Story notes	≤2000
Story reference	≤40
Standup fields	≤2000 each	yesterday, today, blockers; characters, not bytes
OIDC issuer / subject	≤255 each

Request limits

API request body	64 KiB	Global cap on every /api request
Optional-body endpoints	4 KiB	Room-code join and passcode rotate
WebSocket frame read	4096 bytes

Timeouts

ReadHeaderTimeout	10s	HTTP request headers
ReadTimeout / WriteTimeout	30s / 30s	Ordinary HTTP request and response deadlines
IdleTimeout	120s	HTTP keep-alive idle deadline
Shutdown grace	10s	WebSockets close first; in-flight HTTP receives the grace period
/readyz database ping	3s	Readiness also fails, with no timeout of its own, when this replica's notify listener is down
-healthcheck request	3s
OIDC discovery	15s	Lazy and cached after the first success
Database connect	5s	Per attempt
Startup attempts	6	Five doubling backoffs from 1s, plus a 5s timeout each — about a minute

WebSocket

Ping interval	25s
Pong deadline	50s
Write deadline	5s	Per frame
Send buffer	16 frames	Full means the connection is dropped, not the room blocked
Presence debounce	1.5s
Session revalidation interval	≤30s	Shared-store revocation and expiry; does not refresh activity. Logout is fanned out to every replica immediately, so this is the fallback rather than the mechanism
Session validation timeout	≤30s	Failure closes with policy code 1008
Sockets per session token	8	WS_MAX_PER_TOKEN; per replica. Past the cap the upgrade is refused with a 429 before a socket exists, and closing one frees the slot. Several tabs are ordinary use; a second device has its own token and its own budget

Database pool

MaxConns	10	Not configurable
Usable for requests	10	Per replica. The fanout listener and the migration lock each dial outside the pool, so size max_connections for replicas x 11 — 12 per pod briefly at boot, while the migration lock is held
MinConns / lifetimes	pgx defaults	Not set by Parley
Statement timeout	none	Set it on the database role if you want one

Sessions and identity

Session token	32 random bytes	SHA-256 at rest
Server-side token idle expiry	90 days	SESSION_IDLE_TTL. Refreshed by any write or WebSocket connect; a GET never refreshes it
Server-side token absolute expiry	90 days	SESSION_MAX_TTL, measured from issue. No activity extends it
Session cookie Max-Age	90 days	The smaller of the two lifetimes, so the cookie never outlives the token
Sign-in flow cookie	600s	oidc mode only
Expired token cleanup	hourly	A background pass deletes rows past either lifetime

Rules of play

Room-code attempts	8 per 60s	Per client address, per space; sliding window
Open identity creation	10/address/hour	IDENTITY_IP_HOURLY_LIMIT
Open identity creation, instance	500/hour	IDENTITY_GLOBAL_HOURLY_LIMIT
Link redemptions per address	50/address/hour	LINK_REDEMPTION_IP_HOURLY_LIMIT; its own bucket, still under the instance ceiling
Spaces per identity	50	SPACE_LIMIT_PER_IDENTITY
Sessions per space	500	SESSION_LIMIT_PER_SPACE
Saved decks per space	20	DECK_LIMIT_PER_SPACE; over the cap is a 409, and a deck is a template, never a reference a session holds
Kudos per space	500	KUDO_LIMIT_PER_SPACE; over the cap is a 409. The wall reads back the newest 100
Kudo length	280 characters	Counted in runes, and checked again by the database
Stories per session	500	STORY_LIMIT_PER_SESSION
Session participants	200	Hard ceiling on who belongs to one session; attaching past the cap drops the oldest joiner but never the current facilitator. Open-voting snapshots copy at most this many eligible participants (facilitator preferred, then most recent) into the round's expected set
Live signed links per room	20	LINK_LIMIT_PER_SESSION
WebSockets per session token	8	WS_MAX_PER_TOKEN; counted per replica, refused with a 429 before the upgrade
Room-code alphabet	25 characters	Confusable letters removed; ~244M combinations
Facilitator claim grace	60s	Server-measured; claim is one conditional UPDATE
Standup seconds per person	90	A session-config value, but no UI sets it
Poker decks	4 + saved	Chosen at session creation from the four built-ins plus any deck the space has saved; fixed for that session's lifetime
Poker deck cards	2-15	1-8 characters each, no duplicates, no `?` or `coffee`, and finite numbers unless the deck is ordinal; one rule, checked both at session creation and when a deck is saved