A: 1. You mentioned scaling to 500k+ records. Is there actually NO maximum record ceiling per database, and do you offer discounted larger record packs versus $29 per 5k?

No Database Record Ceiling: There is no hard architectural ceiling on database record capacity. The underlying architecture is built to handle multi-million row scale effortlessly, and we currently have active production clients running databases with 4 to 5+ million records without any issues or slowdowns.
Stacking Add-ons: While the self-serve dashboard slider allows purchasing up to +500,000 records in a single transaction, you can purchase and stack multiple add-on packs repeatedly to increase your quota to any record count you need (1M, 2M, 5M+ records).
Bulk / Enterprise Pricing: The self-serve checkout is linear ($29 per 5k records). For high-volume enterprise workloads (e.g., applications requiring 10+ million records per database), you can reach out directly to our support team ([email protected]) to discuss custom high-volume discounted packages.

2. Can you give an actual public API rate/concurrency limit or fair-use threshold? “Fair use” is the one remaining scaling variable I can't quantify.

No Artificial Request Caps: There are no artificial request-per-minute throttles or monthly API call caps on your production REST APIs.
What "Fair Use" Means: Fair use is not a metered cap or hidden overage charge. It refers strictly to platform infrastructure security against malicious abuse (such as volumetric DDoS attacks or runaway unthrottled infinite-loop scripts spamming thousands of requests per second).

3. Can a Developer Token be scoped to specific databases/actions or made read-only so an AI agent cannot alter production?

Developer Tokens used for MCP are account-level tokens. When connected to AI coding assistants (like Cursor, VS Code, Claude Code, etc.), the AI agent gets context across your entire account. This allows the AI to reference different schemas, understand existing table relationships, and assist in designing and managing your databases with full context.
Feature Request Under Review: Database-level scoping for MCP tokens is a great suggestion. While not currently available, we have passed this request to our dev team to explore scoping MCP tokens to specific databases in a future update.

Granular Control via Secret API Keys: If you need granular permissions for applications or services, NoCodeBackend provides Secret API Keys (separate from MCP tokens). Secret API Keys can be restricted with granular precision:
By Database: Scoped to a specific database instance.
By Table: Scoped to individual tables.
By Action: Scoped to specific operations (e.g., read-only, create, update, delete).

4. Is Sign in with Apple on the roadmap? This matters for iOS apps using Google/social login because of Apple's App Store login requirements.

Current Status: At this moment, we do not have an active implementation plan or ETA for native Sign in with Apple. (The natively supported authentication methods remain Email & Password, Email OTP, and Google OAuth, with GitHub auth coming up very soon).
Next Steps: We have passed your request and context regarding Apple App Store review requirements to our developer team so they can evaluate the technical feasibility. For any future updates on authentication features, feel free to reach out to our support team at [email protected].