There are currently no limits set up. We didn’t want to constrain users, but if we detect abuse, w will most likely impose some reasonable limits (like the number of access grants you can register with the same macaroon head).
Also, if you’re looking for more examples of how to interact with Storj-hosted Auth Service, take a look at this gist: How to register an access grant @ Auth Service via HTTP(S) and DRPC(S) · GitHub. They should be fairly easily portable into code (at least HTTP-based ones).