**Use case or problem**
When updating many community plugins at once — common after opening a vault that hasn’t been updated in a while, or on first setup of a new machine — Obsidian can hit GitHub’s unauthenticated API rate limit of 60 requests per hour. The result is a “Your IP address has exceeded GitHub’s limit of 60 file downloads in an hour” error in the Plugin Updates screen, with some plugins failing to update until the limit resets.
This affects users with a large number of installed plugins more than average, but anyone doing a fresh vault setup or bulk update is at risk.
**Proposed solution**
Add a **GitHub Personal Access Token** field to **Settings → Community Plugins**. When populated, Obsidian would include it as an `Authorization: Bearer ` header on all GitHub API requests made during plugin update checks and downloads.
An authenticated GitHub token raises the rate limit from 60 to **5,000 requests per hour** — effectively eliminating the problem for any realistic plugin collection.
The token field should:
- Be stored using Electron’s `safeStorage` API (OS keychain) rather than plaintext in settings
- Be optional — unauthenticated behaviour remains the default
- Link to GitHub’s PAT creation page ( Sign in to GitHub · GitHub ) with a note that a **fine-grained token with no permissions** (read-only public repos, no scopes needed) is sufficient
**Current workaround (optional)**
Wait for the hourly limit to reset, then retry. No way to bypass it within Obsidian today.
**Related feature requests (optional)**
The rate limit only affects plugin update downloads, not vault sync or other operations. This is a targeted, low-complexity fix with a well-understood implementation path.