# Limits and delivery

## Limits

Messages are limited to 4,000 characters, and to four files of up to 8 MB
each. A file's type is read from its bytes, not from the name or the type the
client declared, and a type the agent cannot read is refused with
`unsupported_file_type` rather than stored. Per browser IP and workspace, per
minute: 10 conversations started, 30 messages sent, 60 configuration reads, and
60 conversation lists. Over the limit the SDK surfaces an `error` event and the
underlying request answers HTTP 429; back off rather than retrying immediately.

Every request the SDK makes is checked against the allowed origins of the
publishable token it uses (calls on an open conversation, against those of any
active token of the workspace), so a token lifted from your HTML is useless
from another page. Those origins are what keep a token on your own site; they are not evidence
of who the visitor is. To tell the agent who is signed in, see
[Sessions and channels](https://vatio.ai/docs/authentication/sessions).

## Reply style

| `replyStyle` | Delivery |
|---|---|
| `stream` | Default on web: one complete reply, without artificial delay |
| `paced` | Short messages with typing indicators and pauses |
| `instant` | One complete reply with no typing events |

`stream` is not token-by-token network streaming. Render the received reply
progressively if desired. The style is fixed at chat creation; use `fresh: true`
when changing it.

Use the SDK for realtime delivery. The underlying socket protocol is not a
public integration contract.