Simple, predictable pricing
for code execution

Start safely on Basic, move to recommended Pro for production workflows and opt-in public HTTPS, choose Ultra for serious session usage and domain controls, or use Mega's 200,000-request RapidAPI subscription-period allowance for scale.

Basic
$0/mo
500 requests / RapidAPI subscription period
  • Safe free code execution
  • 8 languages
  • 30s max timeout
  • Up to 10 accepted items per batch
  • Streaming output included
  • gVisor isolation
  • No outbound network
Ultra
$49/mo
50,000 requests / RapidAPI subscription period
  • Everything in Pro
  • 150s sync, stream, and session timeout
  • 300s production async timeout
  • Up to 100 accepted items per batch
  • 5 concurrent sessions
  • Curated popular-package cache
  • Optional exact/wildcard domain rules (max 32)
Mega
$149/mo
200,000 requests / RapidAPI subscription period
  • Everything in Ultra
  • 150s sync, stream, and session timeout
  • 600s production async timeout
  • Up to 200 accepted items per batch
  • 60 requests/minute
  • 8 concurrent sessions · 30m idle max
  • Curated package cache · 300 installs/account/hour
  • Opt-in HTTPS with optional domain rules
  • Planned: customer audit logs; static egress IP is deployment-dependent

Feature comparison

Managed public HTTPS is shipped for paid, opt-in API requests. Customer-facing audit access and a static egress IP remain planned or deployment-dependent. RapidAPI owns the subscription-period allowances; SandboxAPI applies the listed per-minute burst limits without a duplicate calendar-month counter.

Feature Basic Pro Ultra Mega
Monthly price$0$19$49$149
RapidAPI plan requests / subscription period50010,00050,000200,000
Sync / stream timeout30s60s150s150s
Production async timeout30s60s300s600s
Max accepted items / batch1050100200
Service rate limit (req/min)15306060
8 languages✓✓✓✓
gVisor isolation✓✓✓✓
Stdin support✓✓✓✓
Batch execution✓✓✓✓
Streaming output✓✓✓✓
Async pollingEnabled in production · explicit async returns 503 if temporarily unavailable
Stateful sessions—2 concurrent5 concurrent8 concurrent
Session idle maximum—15 min30 min30 min
Session execute timeout—60s150s150s
Package install—direct-artifact wheels/npm · curateddirect-artifact wheels/npm · curateddirect-artifact wheels/npm · curated
Installs / RapidAPI account / hour—60300300
Default network stateOffOffOffOff
Opt-in managed public HTTPS—✓✓✓
allowed_domains controls——Up to 32Up to 32
Production egress defaults—8 concurrent tunnels · 25 MiB aggregate per execution
Structured operator egress logs—✓✓✓
Customer audit logs———Planned
Static egress IP———Planned · deployment-dependent
Hosted MCP — 4 stateless tools✓✓✓✓
RapidAPI bandwidth10,240 MB/month currently included · 1 MB per unit · then $0.001 per MB

RapidAPI's gateway maximum is 180 seconds. SandboxAPI caps response-held sync, stream, session, hosted MCP, and batch work at 150 seconds, retaining 30 seconds for response delivery and cleanup. Ultra's 300s and Mega's 600s limits are production-async only; an explicit async request returns HTTP 503 if that service is temporarily unavailable and never falls back to sync.

Session caps are per-RapidAPI-account ceilings. Shared service capacity is not reserved; during saturation, session creation may return HTTP 503 with Retry-After.

The listed service rate limits are SandboxAPI's per-subscriber burst limits. RapidAPI's separate marketplace rate settings may differ; both layers apply.

Frequently asked questions

Is there a free tier?
Yes. Basic costs $0 per month and includes 500 requests per RapidAPI subscription period. It is designed for evaluation, prototypes, and small workloads.
What counts as one RapidAPI request?
One call to any endpoint counts as one RapidAPI request. A batch call is one request regardless of the number of items; each session endpoint call is a separate request. Batch plan limits are maximum accepted item counts, not parallelism guarantees: items run through bounded workers and the entire batch request has a 150-second wall-clock budget. Starting an async job is one request, and each later polling call is another request.
How is bandwidth billed?
RapidAPI measures bandwidth in 1 MB units, with 10,240 MB/month currently included on every plan, then charges $0.001 per MB above that allowance. This platform fee is separate from the subscription-period request allowance and the proxy's per-execution transfer safety cap. Check RapidAPI for current billing settings.
How do package installs handle dependencies?
Paid session installs publish only the artifacts you explicitly request. pip accepts cached wheels only with --only-binary=:all: --no-deps --no-build-isolation; source distributions are rejected. npm downloads with npm pack --ignore-scripts, validates and extracts the direct package, and strips dependency and lifecycle-script metadata. List every required package explicitly; transitive dependency resolution is planned. The deprecated options.no_deps field is forced true, so setting it to false does not enable dependencies.
What if I reach my request allowance?
RapidAPI applies and resets the request allowance on its subscription period, along with any marketplace overage settings shown for your selected plan. SandboxAPI separately applies only the per-minute burst limit and returns rate-limit headers so clients can throttle proactively.
Can I switch tiers?
Plan changes are managed in your RapidAPI account and follow the marketplace terms shown when you subscribe or change plans.
Is outbound network access available?
Yes, for paid API plans with explicit opt-in on single, streaming, or async execution and on session creation. Network stays off by default, and Basic plus the browser playground cannot enable it. Pro can request managed public HTTPS but cannot submit custom domain rules. Ultra and Mega may optionally provide up to 32 exact domains or explicit *.example.com rules; an empty list means all public HTTPS. Batch execution stays networkless and rejects network.enabled=true so one outbound budget maps to one RapidAPI request. Customer-facing audit logs and a static egress IP remain planned or deployment-dependent.
How is managed HTTPS kept controlled?
The proxy accepts HTTPS CONNECT only on port 443, resolves public IPv4 destinations, rejects raw-IP and private, internal, or special-purpose destinations, pins DNS, requires matching outer TLS SNI, and uses signed short-lived per-execution tokens. This is explicit proxy-based egress, not transparent networking: your client must honor HTTPS_PROXY or be configured for it. Some Node built-in fetch and Java configurations do not do that automatically, and raw public sockets are unavailable. Production defaults cap each execution at 8 concurrent tunnels and 25 MiB aggregate transfer, with duration capped by the execution timeout. It relays opaque TLS rather than inspecting HTTP content, so domain rules are routing controls—not content-level DLP. Connection outcomes are recorded in structured operator egress logs. A session's destination policy is fixed at creation, current plan eligibility is rechecked, and credentials refresh on every execute. Stable pip/npm installs use a separate managed install-proxy path only after firewall/topology and mirror/OSV readiness checks pass; otherwise installs are disabled.
Can I run SandboxAPI on my own infrastructure?
Self-hosting is not currently supported. If you have a regulated-environment or on-premises requirement, contact hello@sandboxapi.dev.
Who handles billing and refunds?
RapidAPI handles self-serve billing, invoices, cancellations, plan changes, and refunds under its marketplace terms.

Start free, then move to Pro

Use Basic to validate your integration. Recommended Pro adds the runtime headroom, sessions, package workflows, and opt-in managed public HTTPS most production apps need.