Assistant limits for visitors vs signed-in customers; API keys cannot use it
You might be here because: “the assistant doesn’t know my plan” · “api keys and oauth tokens cannot use it” · “can I call the assistant from my script” · “why does the chat treat me as a visitor” · “credential not allowed” · “does the chat work in the desktop app” · “the chatbot doesn’t know who I am” · “chat treats me like I’m logged out”
Short answer
Where the assistant is switched on (it can be off on a deployment), anyone can use it as a visitor, behind a browser check, with lower limits and no account facts. Signed in through the dashboard’s session or the desktop app’s sign-in, and with a verified email, you get higher limits and answers that use your own account’s facts. An ordinary API key or an OAuth token is refused with 403 — it is not a programmable endpoint.
Check first
- Signed in on the dashboard, or using the website widget as a visitor?
- Email verified? An unverified account is treated as a visitor for limits and facts.
Likely causes and fixes
- Visitor limits. 6 messages a minute and 20 a day per network address, 3 conversations a day, 2 hand-offs a day.
- Signed-in limits. 10 messages a minute; 20 a day on the Trial, 60 a day on a paid plan; 20 conversations a day.
- “The support assistant is for the dashboard and the desktop app. API keys and OAuth tokens cannot use it.” You sent an API key or OAuth bearer; use the widget while signed in instead. Otherwise every script would get an AI endpoint with the account’s facts.
- Wrong-account facts? The assistant always uses the caller’s own account, never a team workspace header.
- Malformed or expired sign-in. Any Authorization header is checked in full; an invalid one is 401, never a fallback to visitor. Sign in again.
If it still fails
Limits are fixed per tier and not raised per customer. Plan questions are for a person via Help.