The “Too many attempts” message and usage limits
All the rate limits for your account, orders, payments, support tickets, the panel and AI, with the message shown when you go over each one.
On this page
BLACKBOX limits how often you can repeat certain actions on blackbox.md (“Contul meu” (My account), blackbox.md/account) and in the app.blackbox.md panel (“My Servers”, “DNS”, “Monitoring”, “Settings”). When you go over a limit, the action is refused and a message appears, such as “Prea multe încercări…” (Too many attempts…), “Too many requests” or “Rate limit exceeded — …”. Below you will find all the limits, the message shown for each one and what to do.
Available to: any BLACKBOX customer. The limits apply automatically and can't be changed from your account.
The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.
Why limits exist and how they are counted
- Limits protect your account from password guessing and bots, and protect the servers from actions repeated by mistake, for example by a script or by an AI assistant that repeats the same action in a loop.
- The window is sliding: the count covers the attempts made within the interval shown in the table, counted back from the current moment. There is no fixed reset time. Each attempt drops out of the count once the full interval has passed since it was made.
- Some limits are per account, others per IP address. A per-IP limit is shared by everyone who connects to the internet through the same address, for example colleagues in the same office or users of the same VPN.
- For most actions, attempts made while you are blocked also count, so they extend the block: direct sign-in to the panel, the panel buttons (including “DNS”, “Monitoring” and the password change in “Settings”), support tickets, SSH keys, API tokens, balance top-ups, payment from your balance, order cancellations and the AI assistant.
- Attempts made while you are blocked don't count for: sign-up, sign-in on blackbox.md (including with Google or GitLab), changing your account password, the verification email, “Deschide panoul” (Open the panel), placing orders, downloading your data and the account deletion request.
- The panel buttons and the AI assistant (MCP) have separate limits: using one doesn't use up the limits of the other.
Warning Don't retry in a loop and don't click a button several times. Wait for the full interval in the table, counted from your last attempt, then try just once.
How to recognize a limit
- A message in the language of the website or the panel: on blackbox.md, which is in Romanian, “Prea multe încercări…” (Too many attempts…) or “Prea multe tichete create recent…” (Too many tickets created recently…); in the panel, “Too many changes…” or “Too many requests…”.
- A message in English, passed on directly by the server: “Too many requests”, “Too many 2FA attempts”, “Too many attempts. Try again later.” or “Rate limit exceeded — …”. The last one usually also states the limit, for example “… limited to 6 requests per 60 seconds”. The AI assistant receives the
rate_limitedcode. - No message about the limit. A few screens don't tell you that you have reached the limit:
- direct sign-in on app.blackbox.md shows “Invalid username or password.” even when the password is correct;
- “Trimite emailul de verificare” (Send verification email) shows “Email trimis. Verifică căsuța poștală.” (Email sent. Check your inbox.), but the email is no longer sent;
- “Deschide panoul” (Open the panel) opens the panel's sign-in page instead of signing you in;
- other screens show a general error, given in the “What you see over the limit” column of the tables below.
What to do when the message appears
- Stop: don't click the button again and don't keep reloading the page.
- Find the action in the tables below and wait for its interval, counted from your last attempt.
- Reload the page and try just once.
- If the limit is per IP address and the block continues, someone else on the same network may be doing the same action. Wait one more interval.
- If the message still appears after you have waited without repeating the action, write to us: How to contact BLACKBOX support. Include the action, the time and the exact message.
Account and sign-in
| Action | Limit | What you see over the limit |
|---|---|---|
| Sign-up (“Creare cont” (Create account)) | 5 in 10 minutes from the same IP address | “Prea multe încercări. Vă rugăm încercați din nou peste câteva minute.” (Too many attempts. Please try again in a few minutes.) |
| Sign-in on blackbox.md (“Autentificare” (Sign in)) | 5 in 5 minutes for the same email address; 20 in 5 minutes from the same IP address | “Prea multe încercări de autentificare. Vă rugăm încercați din nou peste câteva minute.” (Too many sign-in attempts. Please try again in a few minutes.) |
| Sign-in with Google or GitLab | 30 per hour from the same IP address | a page with the text {"detail":"Too many requests"} |
| Changing your password (“Profilul meu” (My profile) → “Schimbă parola” (Change password) → “Salvează parola” (Save password)) | 5 per hour per account; 20 per hour from the same IP address | “Prea multe încercări. Vă rugăm încercați din nou peste câteva minute.” |
| The verification email (“Trimite emailul de verificare” (Send verification email)) | 3 per hour per account; 20 per hour from the same IP address | “Email trimis. Verifică căsuța poștală.” (Email sent. Check your inbox.), but the email isn't sent |
| “Deschide panoul” (Open the panel) and the other links to the panel in “Contul meu” (My account) | 10 per hour per account; 30 per hour from the same IP address | the panel's sign-in page opens |
| Downloading your data (“Descarcă datele mele” (Download my data)) | 3 in 24 hours per account; 10 in 24 hours from the same IP address | “Eroare la descărcare. Încercați din nou.” (Download error. Please try again.) |
| Account deletion request (“Șterge contul meu” (Delete my account)) | 5 per hour per account; 20 per hour from the same IP address | “Prea multe încercări. Încercați mai târziu.” (Too many attempts. Try again later.) |
| Direct sign-in on app.blackbox.md | 5 in 5 minutes for the same username; 20 in 5 minutes from the same IP address | “Invalid username or password.” |
| The 2FA code in the panel | 5 attempts per sign-in; the step expires after 5 minutes | “Too many 2FA attempts”; start signing in again from the beginning |
| Changing your password in the panel (“Settings” → “Change Password”) | 5 in 15 minutes per account; 20 in 15 minutes from the same IP address | “Too many attempts. Try again later.” |
Orders and payments
| Action | Limit | What you see over the limit |
|---|---|---|
| Placing an order | 10 per hour from the same IP address; 30 per hour per account | the “Eroare la plasarea comenzii” (Error placing the order) card, with the text “Eroare la plasarea comenzii. Vă rugăm încercați din nou.” (Error placing the order. Please try again.) |
| Topping up your balance (the “Alimentează soldul” (Top up balance) page) | 5 per hour per account | “Prea multe încercări. Vă rugăm încercați din nou peste câteva minute.” (Too many attempts. Please try again in a few minutes.) |
| Paying from your balance (“Achitați din sold” (Pay from balance)) | 10 per minute per account | “Eroare la inițierea plății. Vă rugăm încercați din nou.” (Error starting the payment. Please try again.) |
| Canceling an order (“Anulează comanda” (Cancel the order)) | 10 per minute per account; in addition, 3 in 5 minutes for orders whose server has already been created or failed to be created | “Too many requests” |
Support tickets
The “Tichete de suport” (Support tickets) page (“Contul meu” (My account) → “Ajutor și suport” (Help and support)):
| Action | Limit | What you see over the limit |
|---|---|---|
| New ticket (“Tichet nou” (New ticket) → “Trimite tichetul” (Send ticket)) | 5 per hour per account | “Prea multe tichete create recent. Încercați mai târziu.” (Too many tickets created recently. Please try again later.) |
| Replying in a ticket (“Trimite” (Send)) | 20 per hour per account | “Rate limit exceeded — try again later” |
SSH keys and API tokens
The “Chei SSH” (SSH keys) and “Token-uri API” (API tokens) pages in “Contul meu” (My account):
| Action | Limit | What you see over the limit |
|---|---|---|
| Adding a key (“Adaugă cheia” (Add key)) | 10 per hour per account | “Nu am putut adăuga cheia.” (We couldn't add the key.) |
| Deleting a key (“Șterge” (Delete)) | 20 per hour per account | no message; the key stays in the list |
| Creating a token (“Creează token” (Create token)) | 10 per hour per account | “Too many requests” |
The app.blackbox.md panel
The limits for the buttons on the server card in “My Servers” are per account: they add up across all your servers.
| Action | Limit | What you see over the limit |
|---|---|---|
| Renaming (the “Rename” pencil) | 30 in 5 minutes | “Too many changes. Please try again in a few minutes.” |
| “Reveal credentials” | 20 per minute | “Rate limit exceeded — credentials view is limited to 20 requests per 60 seconds” |
| “Reset password” | 3 in 5 minutes | “Rate limit exceeded — password reset is limited to 3 requests per 5 minutes” |
| “Reboot”, “Stop”, “Start” | 6 per minute, for all servers combined | “Rate limit exceeded — power actions are limited to 6 requests per 60 seconds” |
| “Add SSH key” → “Add key” | 10 in 5 minutes | “Rate limit exceeded — adding a key is limited to 10 requests per 5 minutes” |
| “Remove” on a key in “Installed keys” | 10 in 5 minutes | “Failed to remove the key.” |
| Loading the “Installed keys” list | 30 per minute | “Rate limit exceeded — listing keys is limited to 30 requests per 60 seconds” |
| “Disable password login” / “Enable password login” | 5 in 5 minutes | “Failed to change password login.” |
| “Upgrade” → “Upgrade server” | 3 in 10 minutes | “Rate limit exceeded — resize is limited to 3 requests per 600 seconds” |
| “DNS”: connecting a provider (“Connect”) | 5 in 10 minutes | “Too many requests. Try again shortly.” |
| “DNS”: adding, editing and deleting records, “Verify”, “Disconnect” | 60 per minute | the same message |
| “DNS”: loading connections, zones and records | 120 per minute | the same message |
| “Monitoring”: loading the server list and the charts | 30 and 60 per minute, respectively | rate_limited |
The message “The provider is rate-limiting requests. Try again shortly.” on the “DNS” page comes from Cloudflare or GoDaddy, not from BLACKBOX. Wait a few minutes and try again.
Tip “Reboot”, “Stop” and “Start” don't show a success message: the button becomes active again as soon as the command is accepted. Don't click again; check after a minute, for example over SSH. Details: Rebooting, stopping and starting a server.
The AI assistant (MCP)
- An account can make at most 120 tool calls per minute, for all its tokens and all AI clients combined.
- In addition, many tools have a limit of their own, for example 6 start, stop or reboot actions per minute (
power_server) or 3 upgrade requests in 10 minutes (resize_server). - Over the limit, the tool responds with
rate_limited. Ask the assistant to stop and resume after a minute. - The full table of tools: MCP limits and error codes.
Frequently asked questions
Can I ask for a limit to be raised? The limits are the same for all customers and can't be changed from your account. If they often block your normal work, write to us and describe what you are doing: How to contact BLACKBOX support.
The limit kicked in after a single attempt. Why? You share the per-IP limit with everyone else on the same network, and the per-account limit with all the tabs and devices where you are signed in. Wait for the interval in the table and try again.
The panel shows “Invalid username or password.” even though my password is correct. You have probably gone over 5 attempts in 5 minutes. Wait 5 minutes without trying again, or sign in from blackbox.md with “Deschide panoul” (Open the panel). Other causes: I can't sign in to my account or the panel.
I requested the verification email several times and didn't receive it. After 3 requests in an hour, the message “Email trimis. Verifică căsuța poștală.” (Email sent. Check your inbox.) still appears, but the email is no longer sent. Check your Spam folder, wait an hour and request it just once. Details: Verifying your email address.
Does the AI assistant use up my panel limits? No. The panel buttons and the AI assistant have separate limits. The assistant's limits apply to all of the account's tokens combined.
What do the other panel errors mean? See Panel error messages and what they mean.