Limits in early access

Houseguest™ is in early access as a hosted service. This page lists the limits that apply today. The self-hosted edition is available on the Enterprise plan.

Workspace limits (hosted)

New workspaces start on the Early access plan:

Limit	Early access
Agents	5
Open previews at once (scheduled ones count)	25
People per preview (the person who opened it does not count)	50
Emails per day (invites, codes, reminders; resets at 00:00 UTC)	100
Different people sent invitations per day (UTC)	50
Invitations per hour (emailed or made as links)	30
TCP services and the browser terminal	On
Terminal shares (`houseguest share`) running at once, per person	5
Longest terminal share	7 days
Single sign-on for console members	Included

The console’s Overview shows usage against these limits, and Billing shows your plan. If you need more, ask us: limits can be raised per workspace. Changing a limit never closes anything already open.

When a limit is reached, the console says so: for example limit reached: this account can have 25 previews open at once; end one first.

A self-hosted edge has no workspace limits.

Fixed caps

What	Cap
Invite previews	Open at most 7 days from now (extendable within that)
Standing access	Open at most 1 year from now
Scheduled start	At most 90 days ahead
Preview name	2 to 31 lowercase letters, digits or hyphens
Hostnames per preview	Any number, under one shared parent domain
A hostname	In one open or scheduled preview at a time
Email code	10 minutes, 5 wrong tries, a new one after 30 seconds, 5 an hour
Standing-access code requests	10 an hour from one network address
Join token	Single use, 1 hour
Console sign-in	30 days without use by default; the workspace can shorten it
Browser terminal	Closes after 30 minutes without activity
Terminal share (`houseguest share`)	At most 7 days (8 hours on Free); ends 90 seconds after its computer goes away
Command-line console sign-in (`houseguest share`)	12 hours, within the console session
Request log	Kept 90 days

Not available yet

SCIM provisioning and group claims from the identity provider. Groups are managed by hand. Single sign-on itself is included in Early access and the Business plan.
Sign in with Google. Sign in with Microsoft is available to members and viewers; viewers in your single sign-on domains use your identity provider; everyone else signs in with an emailed code.
An API or command line for workspace administration. Everything is in the console.
IPv6 for shared hostnames: use A or CNAME records, and no AAAA record.
Plain-HTTP apps: the agent always connects with TLS. Put a TLS reverse proxy in front. (Apps on your own computer shared with houseguest share may be plain HTTP.)
Viewer identity for the app: Houseguest does not pass the viewer’s address to your app, which keeps using its own login.
Page rewriting on Houseguest addresses: apps that write absolute links with their internal hostname need their own hostnames.
Wildcards deeper than one label in an agent’s allow-list.
Agent self-update: updates run on the agent’s host.