Authentication and limits

Fluxtail fails closed when it cannot verify account identity or the shared event budget.

Shared receiver authentication

A shared request must provide one valid receiver-bound Bearer token. Fluxtail verifies the token, receiver, user, account, and requested protocol. Removal or revocation takes effect in ingest within the short authentication cache window, currently up to 30 seconds.

Dedicated receiver authentication

Dedicated protocols use the assigned public destination and source IPv4 or CIDR rules. TCP receivers that require TLS also verify the public certificate and hostname at the sender.

Event limits

Shared and dedicated receivers consume one events-per-second budget per account. If Fluxtail cannot check the budget, ingest rejects the traffic. A 429 means the verified limit is exceeded; a 503 means a required check is unavailable.

Retry 503 with exponential backoff and jitter. Do not retry 401, 403, or 415 until the configuration is corrected.

Plan limits

Plans limit stored decimal GB, fixed-second events, dedicated ports, native sources, and retention. There is no usage overage at launch. Dedicated receivers cannot be created or restored above the active or scheduled future limit.

See Usage for stored usage definitions.