> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allocait.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and limit errors

> Errors for read-only access, account limits, rate limits and sign-in.

| What you see | Where it comes from |
| - | - |
| `TIER_LIMIT_EXCEEDED`, `FEATURE_NOT_AVAILABLE`, `DAILY_LIMIT_EXCEEDED` | A tool result |
| `READ_ONLY_KEY`, `OAUTH_WRITE_NOT_GRANTED` | A tool result |
| HTTP `429` | Before any tool runs |
| `ACCESS_CHECK_FAILED`, HTTP `401`, HTTP `403`, consent screen messages | Before any tool runs, connector sign-in only |

## Account limits

**TIER\_LIMIT\_EXCEEDED**

An account limit was reached: the number of portfolios or scenarios the account allows, 50 watchlists, 200 symbols on one watchlist, or 50 custom symbols on one monitor. For portfolios and scenarios the message reads "Portfolio limit reached. This account has reached its portfolio limit." (or "Scenario limit reached. This account has reached its scenario limit."). The error carries `limit_type`, `current_count` and `max_allowed`. Retrying doesn't help until the user removes one, or manages the account in the Allocait app.

**FEATURE\_NOT\_AVAILABLE**

The account doesn't include the feature, for example a connection with Read and change access. The message reads "This account doesn't include this. Ask the user." The agent tells the user in plain words and doesn't retry. See [Access levels](https://docs.allocait.app/concepts/access-levels.md).

**DAILY\_LIMIT\_EXCEEDED**

A daily cap on this kind of write was reached, such as 20 feedback reports in 24 hours. Stop for now; the limit resets within a day.

## Read-only access

A read-only connection lists only the 12 read tools and `send_feedback`, which works there for `topic: tools` and `topic: early_access`; `topic: account` returns one of the codes below. Some accounts allow read-only agent access: see [Access levels](https://docs.allocait.app/concepts/access-levels.md). These codes come back when Claude calls a tool that changes data anyway. Each is a tool result, not an HTTP `403`.

**READ\_ONLY\_KEY**

The API key can only read. To let Claude change data, create a key with **Read and change** access in **Settings > API keys**. If the result says "This account's agent access is read-only.", the account allows reads only. A new key doesn't help; manage the account in the Allocait app.

**OAUTH\_WRITE\_NOT\_GRANTED**

The app connected through the connector sign-in can only read. To allow changes, select **Edit access** for the app in **Settings > Apps**. A client may need to reconnect before it lists the write tools. If the result says "This account's agent access is read-only.", the account allows reads only, whatever you chose on the consent screen. Editing the app's access doesn't help; manage the account in the Allocait app.

## Rate limit

If a connection goes past its request budget, the server answers with HTTP `429` before any tool runs, so there is no `Error [CODE]` line. Your MCP client may show this as a connection error rather than a tool error.

MCP calls and REST calls share both budgets: 60 requests per minute and 10,000 per UTC day. See [Rate limits](https://docs.allocait.app/api/rate-limits.md) for the response bodies, the headers and the per-route caps.

The server doesn't accept JSON-RPC batches. A batched request gets HTTP `400` with JSON-RPC error `-32600`; send one message per request.

## Connector sign-in

These errors apply only to apps connected through the connector sign-in, not to API keys. Like the rate limit, they come back before any tool runs.

**ACCESS\_CHECK\_FAILED**

HTTP `503`. Allocait couldn't check the app's access, so it refused the request. The body is `{"error": "Could not verify access. Try again.", "error_code": "ACCESS_CHECK_FAILED"}`. Retry the request.

HTTP `401` with `WWW-Authenticate: Bearer error="invalid_token"` means the access token is invalid or expired, or you removed the app. The body is `{"error": "Invalid or expired access token"}` or `{"error": "This connection was removed. Connect again from your app."}`. Connect again from your client. If that doesn't work, remove the connector in your client and add it again.

If the account has no agent access, every request fails with HTTP `403` until the user manages the account in the Allocait app. Reconnecting doesn't help.

### Consent screen messages

The consent screen shows these messages in your browser. If the account can't connect an app, the screen says "This account can't connect an app right now. Manage your account in the Allocait app." and offers only **Deny**. Manage the account, then start the connection again from Claude.

| Message | What it means | What to do |
| - | - | - |
| This link expired. Start the connection again from your app. | The connection request expired or was already used. | Start the connection again from Claude. |
| This request was already used. Start again from your app. | The connection request was already approved or declined. | Start the connection again from Claude. |
| *App* asked for your sign-in details, which Allocait does not share with connected apps. | The app requested the `openid` scope. Allocait refuses it, and nothing is shared. | This app can't connect through sign-in. Use an [API key](https://docs.allocait.app/claude/connect-with-api-key.md). |
| *App* uses a return address Allocait does not support. | Allocait supports `https` return addresses, and `http` only on `localhost`, `127.0.0.1`, or `[::1]`. A custom scheme such as `cursor://` is refused. Nothing is shared. | This app can't connect through sign-in. Use an [API key](https://docs.allocait.app/claude/connect-with-api-key.md). |

## Next steps

> [card] [Access levels](https://docs.allocait.app/concepts/access-levels.md)
>
> What Read only and Read and change allow.

> [card] [Rate limits](https://docs.allocait.app/api/rate-limits.md)
>
> Budgets, headers and the 429 response.

> [card] [All MCP errors](https://docs.allocait.app/claude/errors.md)
>
> Find another code.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.