Resource limits

	Prototype	Hobby	Team
Lease	7 days	30 days	30 days
Storage	250 MB	1 GB	10 GB
API calls	500K	5M	50M
Functions	5	25	100
Function timeout	10s	30s	60s
Function memory	128 MB	256 MB	512 MB
Secrets	10	50	200
Scheduled fns	1 / 15min	3 / 5min	10 / 1min

Project rate limit: 100 req/sec — exceeding throws ApiError with status 429 and retry_after in the body.

Idempotent migrations

CREATE TABLE IF NOT EXISTS only handles “already exists” — it won’t add new columns. For evolving schemas, wrap ALTER TABLE in a DO block:

CREATE TABLE IF NOT EXISTS items (id serial PRIMARY KEY, title text NOT NULL);
DO $$ BEGIN
  ALTER TABLE items ADD COLUMN priority int DEFAULT 0;
EXCEPTION WHEN duplicate_column THEN NULL;
END $$;

Safe to re-run on every deploy.

SQL guardrails

The SQL endpoint blocks: CREATE EXTENSION, COPY ... PROGRAM, ALTER SYSTEM, SET search_path, CREATE/DROP SCHEMA, GRANT/REVOKE, CREATE/DROP ROLE. Use the expose manifest for access control.

Stability

This package is on the 3.x line. The in-repo packages (@run402/sdk, run402, and run402-mcp) release in lockstep at the same version. Pin an exact version in production dependencies:

{ "dependencies": { "@run402/sdk": "3.7.5" } }

OpenClaw skill packaging follows the CLI release train. @run402/functions and @run402/astro publish on their own cadences.

Patterns & gotchas

Never paste a key into HTML. Every Run402 host serves /_run402/config.js (window.RUN402 = { project_id, api_base, anon_key }) for the project it resolves to at request time; load that instead. The anon_key is public by design.
Use the manifest for access control, never raw GRANT/REVOKE.
user_owns_rows is the default for user-scoped data. Reach for public_read_write_UNRESTRICTED only on intentionally-public tables.
Use immutable cdnUrl from r.assets.put. It’s correct from the moment of upload — no waitFresh needed.
Don’t bake unconditional r.allowance.faucet() into deploy scripts — the faucet rate-limits and breaks already-funded flows.
Per-project rate limit is 100 req/sec. On 429, back off using retry_after.
r.service.status() works without auth. Use it before evaluating Run402, or to distinguish platform issues from your own bugs.

Resource limits

Resource limits

Idempotent migrations

SQL guardrails

Stability

Patterns & gotchas

See also