Limits and revocation

The three controls

Every relay link (see Relay links) can carry three independent controls:

• Expiry. Set a date after which the link stops working on its own, with no action needed from you.
• Traffic cap. Set a ceiling on how much traffic can pass through a link before it stops being served.
• Revocation (kill switch). Turn a link off immediately, at any time, for any reason - without touching any other renter’s link and without rotating the upstream password those other links depend on.

All three exist because a relay link is a bearer credential (see Security model): the controls, not an identity check on the holder, are what actually bound the damage if a link leaks.

Honest caveat: the usage ledger lags

Traffic usage is not accounted byte by byte in real time. The data plane batches usage and writes it back to the control plane periodically, so the usage ledger can lag by up to about five minutes behind actual consumption. In practice that means a traffic cap can be briefly overrun: a link can keep being served for a few minutes past its cap before the write-back catches up and the control plane cuts it off. If you need a hard, no-overrun ceiling, size your traffic caps with that lag in mind.

Honest caveat: revocation has the same lag as the caches it depends on

Revocation updates the control plane immediately, but the data plane only checks in periodically, so a revoked link can stay usable for up to about 60 seconds while the edge cache expires. See Security model for the full explanation of why that delay exists.