Replicate
AI · AI
Model predictions, fine-tuning trainings, and the public model catalogue on their key.
Connecting Replicate in practice
Replicate deletes the inputs, outputs, output files and logs of an API prediction about an hour after it runs, while predictions created in the web interface are kept indefinitely — so anything an agent needs to keep has to be copied inside that hour. Creating predictions is capped at 600 requests a minute and every other endpoint at 3,000, and the limits tighten automatically as the account’s credit balance runs down.
Scopes that draw scrutiny
r8_… API token (Bearer)A 40-character secret with no scopes: it can run any model, start trainings that bill compute, and read the account’s predictions. Multiple tokens can be created and disabled individually, which is the only isolation on offer.Secret inputsModels can declare secret inputs for API keys and passwords passed through Replicate at prediction time, so third-party credentials may transit the platform.
Rate limits
- Create a prediction: 600 requests per minute.
- All other endpoints: 3,000 requests per minute.
- Short bursts above the default are tolerated before throttling.
- Accounts with granted credit and no payment method on file are limited to 1 request per second and a maximum of 6 per minute.
- 429 responses carry a body such as {"detail":"Request was throttled. Your rate limit resets in ~30s."}.
Worth knowing
- Stronger rate limits kick in as credit runs low, deliberately, so an agent can slow down for billing reasons that look like a platform incident; Replicate suggests credit auto-reload above $20 to avoid it.
- Since version 1.0.0 of the client libraries, replicate.run() returns FileOutput objects rather than URLs, so code written against the old string-URL behaviour breaks on upgrade.
- Deleting a prediction from the dashboard removes its outputs and output files permanently, and subsequent reads of a deleted prediction do not come back.
- Community models and official models are documented as different things, with different reliability expectations, so pinning a model version matters for anything unattended.
Checked against Rate limits (2026-09-29), Data retention (2026-09-29), API tokens (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Replicate behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.