Hetzner limits that shape a node group
Last updated
Hetzner Cloud limits how many API requests a project may send, and how many servers, Primary IPs, placement groups, network attachments, load balancer targets and firewalls an account or a project may hold. A node group meets these limits as it grows. The table lists the ones that shape a node group, with Hetzner’s numbers as Hetzner’s own pages stated them on 18 October 2026, and what Hetscale does about each. Your account’s own numbers are on the Limits tab of the Hetzner Console, and they can differ from these defaults.
Which Hetzner limits does a node group meet?
| Limit | Hetzner’s number | What Hetscale does |
|---|---|---|
| API requests | 3,600 an hour per project by default, refilled gradually and shared by every token of the project. Requests to action endpoints, such as adding a load balancer target or shutting a server down, count in a separate pool of twice that, Hetzner support told us in September 2026 | Reads your load balancer’s metrics every minute. Reads each server’s CPU every minute while the node groups of your project hold up to 25 servers, every 2 minutes up to 50, and every 5 minutes above that. Stops polling early enough to keep a reserve for creating, draining and deleting servers. Stock is read from Hetscale’s own Hetzner project, so it costs your project nothing. A 429 pauses decisions and is never read as a missing server. |
| Servers and vCPUs | A default limit per account; Hetzner’s server overview lists up to 20 shared and 8 dedicated vCPUs by default | Hetscale does not read your account’s limits. When Hetzner refuses a new server with its account-limit answer, the node group pauses with “Hetzner account limit reached” and you get a mail, which names the limit when Hetzner’s answer does. Running servers keep running. Raise the limit, or free what it counts, then Resume. |
| Primary IPs | One IPv4 and one IPv6 per server; in all, twice the account’s server limit | Each new server takes the seed’s public addresses, so one or two Primary IPs. When it takes any, the (i) beside Max at Go Live and in Settings shows how many each new server takes and how many the project uses. Hetscale names the limit but cannot enforce it, and a refusal pauses the node group as above. A server without public addresses takes none (Servers without public addresses). |
| Placement groups | 10 servers per spread placement group, 50 placement groups per project, one per server | While Spread servers across hosts is on (the default), Hetscale spreads the servers it creates over placement groups of its own, up to ten per group, and opens the next one as the node group grows. The preflight of Take release v1 warns when fewer than 5 of the project’s 50 are free. In three cases the server is created anyway and marked “Not spread”: no placement group can be created, Hetzner cannot place the server apart from the others, or its placement group was deleted in the Hetzner Console (Placement groups). |
| Private network | 100 attached servers and load balancers per network; 3 networks per server | New servers join the networks the seed was in when release v1 was taken. At Go Live and in Settings, Max stays within the room on the tightest of those networks: 100, less the servers and load balancers on it that are not the node group’s, less one place kept free for a replacement. The (i) beside Max says what the network held at Hetscale’s latest read of the project, and how long ago that read was. |
| Load balancer targets | LB11 25, LB21 75, LB31 150 | Hetscale takes your load balancer’s target limit and its targets from its latest read of the project. When Observe starts, at Go Live and in Settings it keeps Max, your own servers in the node group included, at the limit less the targets that are not servers of the node group, less one target kept free so that a replacement can join beside the server it replaces. A larger load balancer type raises the limit. |
| Load balancer connections | LB11 10,000, LB21 20,000, LB31 40,000 | Hetscale reads your load balancer’s open connections, and a rule you add can scale on them. When every minute of the last 10 held 80% or more of the type’s limit, the node group’s Overview says the load balancer is near its connection limit and you get a notice; a scale-out in that time says so in its reason and still goes ahead. The day-0 report names the limit when the 95th percentile of the last 30 days reached that share. Adding servers does not raise it; a larger load balancer type does, and Hetscale never changes the load balancer. |
| Network zone | A load balancer and its targets are in the same network zone | Every location Hetscale tries for a new server is in the load balancer’s network zone. Another zone is never tried (When your Hetzner server type is sold out). |
| Firewalls | 5 per server; 50 per account, across all projects; up to 500 effective rules each; up to 80,000 concurrent connections per server. Hetzner’s firewalls do not yet filter private network traffic and cannot yet be applied to a load balancer (firewall FAQ) | A new server with a public address gets the firewalls the seed had when release v1 was taken; a server without one gets none. Hetscale creates, changes and deletes no firewall, and does not read the connection limit. |
| Projects | 20 per account by default | Give each application its own Hetzner project: the API budget is counted per project, and a token reaches its whole project (Security). |
How do I see and raise my Hetzner limits?
Open the Limits tab on the overview page of the Hetzner Console. To raise a limit, choose Request change → Limit increase there. Hetzner’s FAQ says it reviews these requests by hand, case by case, during its business hours. Hetzner’s server FAQ adds that an increase is possible once you have been a customer for a month and paid your first invoice, so set a new account’s Max within the limits it has. A limit reached after Go Live pauses the node group at the create Hetzner refuses; the servers that run keep running (A node group is paused).
Which of these limits does Hetscale not check?
- What changed since Hetscale’s latest read of the project. The bounds on Max come from that read, which runs when you connect the project, replace its token, turn on delete protection, promote the seed or choose Read again: a target added to the load balancer, or a server or load balancer attached to the seed’s network, after it counts only from the next read. A label-selector target counts as one target, however many servers it matches.
- Two node groups on the same load balancer or network: each gets its bound on its own, so together they can still go past it.
- A Max set before these bounds applied. It stays until a save changes Min or Max, and until then the node group can still meet Hetzner’s refusal.
- The connections of a server behind a firewall. Your load balancer’s connections are watched (above) and never hold a scale-out.
- Your account’s servers, vCPUs and Primary IPs. Hetscale shows the Primary IPs each new server takes, but only Hetzner’s answer to a create tells whether the account has room.
What Hetscale does with each answer Hetzner gives, including the account-limit refusal and the rate limit, is on Hetzner API errors and what Hetscale does.
What does this page not cover?
Hetzner limits that do not bear on a node group, such as volumes or Floating IPs, are on the Hetzner pages linked above. Those pages stay the source whenever a number changes. Hetscale’s own holds on new servers are on A node group is servers short: your plan, a euro ceiling, the cost guard and the node cap.