{"record":{"id":"fe26f41da524a6a4","repo":"gravitational/teleport","slug":"tokens-quota-exceeded-contact-your-teleport-admin","errorCode":null,"errorMessage":"tokens quota exceeded. Contact your Teleport administrator","messagePattern":"tokens quota exceeded\\. Contact your Teleport administrator","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/srv/app/llm/errors/errors.go","lineNumber":49,"sourceCode":"\tErrTimeout = errors.New(\"the request timed out. Try again or use streaming for long responses\")\n\t// ErrBadRequest returned when the request has bad format or invalid fields.\n\tErrBadRequest = errors.New(\"the inference provider rejected the request as invalid. Check the request body for unsupported or invalid fields\")\n\t// ErrCanceled returned when the request is canceled.\n\tErrCanceled = errors.New(\"the request was canceled\")\n\t// ErrUnauthorized returned when the request is unauthorized.\n\tErrUnauthorized = errors.New(\"the inference provider rejected the request due to authentication or authorization configuration. Contact your Teleport administrator\")\n\t// ErrRejected returned when the provider rejects the request.\n\tErrRejected = errors.New(\"the inference provider rejected the request due to usage limits. Contact your Teleport administrator\")\n\t// ErrUnsupported returned when the requested endpoint is not supported.\n\tErrUnsupported = errors.New(\"teleport doesn't support the requested endpoint, please check the list of supported endpoints in the documentation\")\n\t// ErrBadResponse returned when the provider replied the request with an unsupported message or format.\n\tErrBadResponse = errors.New(\"the inference provider returned an unexpected response. Contact your Teleport administrator\")\n\t// ErrConfig returned when the app or app service are misconfigured, requiring admin intervention.\n\tErrConfig = errors.New(\"unable to serve request due to an app configuration error. Contact your Teleport administrator\")\n\t// ErrInternal returned when there is a Teleport processing error (nothing to do with the inference provider).\n\tErrInternal = errors.New(\"unable to serve the request due to an internal error. Contact your Teleport administrator\")\n\t// ErrLimitExceeded returned when Teleport rejects the request due to limit exceeded.\n\tErrLimitExceeded = errors.New(\"tokens quota exceeded. Contact your Teleport administrator\")\n\t// ErrUnknown returned when the handler could not identify the error.\n\tErrUnknown = errors.New(\"the inference provider returned an unexpected error. Contact your Teleport administrator\")\n)\n\n// ProviderError is an error in the provider format.\ntype ProviderError struct {\n\terr    error\n\tdetail string\n}\n\n// NewProviderError creates a new provider error with details.\nfunc NewProviderError(err error, detail string, args ...any) *ProviderError {\n\tif len(args) > 0 {\n\t\tdetail = fmt.Sprintf(detail, args...)\n\t}\n\treturn &ProviderError{err, detail}\n}\n","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/app/llm/errors/errors.go#L31-L67","documentation":"ErrLimitExceeded is returned when Teleport rejects an LLM request because the token quota has been exceeded. It maps to HTTP 429 (StatusTooManyRequests) in StatusCodeFromErr and to the provider's rate-limit error type in provider response mapping (e.g. anthropic.go).","triggerScenarios":"A request goes through the quota Reservation path (Reserve) and the token budget for the user/workspace is exhausted; the handler then wraps/rejects with ErrLimitExceeded.","commonSituations":"Heavy model usage during the billing period, shared quota consumed by a team, or automated scripts issuing many large prompts until the quota reserve is denied.","solutions":["Wait until the quota window resets before issuing more requests","Reduce token usage: shorten prompts, cap max_tokens, batch less","Ask your Teleport administrator to raise the token quota for your role/workspace","Check usage monitoring to identify which users/requests exhausted the budget"],"exampleFix":"// before: ignore quota errors, retry blindly\nresp, err := client.Complete(ctx, req)\n// after: back off on rate-limit errors\nresp, err := client.Complete(ctx, req)\nif llmerrors.IsLimitExceeded(err) {\n  return nil, backoff.Retry(ctx, req, backoff.NewExponential())\n}","handlingStrategy":"validation","validationCode":"// estimate token usage and check remaining quota before the call\nneeded := estimateTokens(req.Prompt) + req.MaxTokens\nif needed > quota.Remaining(identity) {\n  return errors.New(\"request exceeds remaining token quota\")\n}","typeGuard":"func isLimitExceeded(err error) bool {\n  return errors.Is(err, llmerrors.ErrLimitExceeded)\n}","tryCatchPattern":"err := doLLMRequest(ctx, req)\nif errors.Is(err, llmerrors.ErrLimitExceeded) {\n  // honor Retry-After / back off until quota resets\n  return waitForQuotaReset(ctx, identity)\n}","preventionTips":["Track token usage per user and pre-emptively throttle","Cap max_tokens on all requests","Alert on quota consumption approaching the limit"],"tags":["teleport","rate-limit","quota","llm-proxy"],"backgroundTag":"rate-limit-exceeded","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}