Rate limits
How many requests one IP address may make against your auth endpoints, and how to change it.
Five auth actions are throttled per IP address. They exist so a single caller cannot grind through passwords, burn one-time codes, or enumerate which emails have an account.
The limits are yours to set, per environment, in the Console under Authentication → Rate limits.
What is counted
Sign-ins30OptionalSign-in attempts. The one that matters for credential stuffing.
Token refreshes150OptionalSession token refreshes. Higher because a busy app refreshes legitimately.
Verifications30OptionalOTP and magic-link verifications.
Sudo mode5OptionalPrivilege elevation. The tightest, because each one guards a sensitive action.
Lookups30OptionalIdentifier checks — does this email, phone or username exist. Throttled because an unthrottled lookup is an account enumeration endpoint.
How the window works
Each number is the count allowed in a fixed five-minute window, per IP
address — not per minute. A sign-in limit of 30 means thirty attempts from
one address in five minutes, then rejections until the window rolls over.
Five minutes is server-controlled and the same for every action. The API returns
it as minutes alongside the limits, so a client never has to assume it.
Per IP, not per user
Two people behind one office network share a bucket. If your users are concentrated behind a NAT or a corporate proxy, raise the limits — the default assumes ordinary residential traffic.
Being throttled
{
"status_code": 429,
"message": "rate limit exceeded",
"code": "rate_limit_exceeded",
"retryAfter": 300
}retryAfter is in seconds and tells you when the window clears. Back off for
that long rather than retrying immediately — a retry loop against a throttled
endpoint keeps the bucket empty and turns a brief limit into a permanent one.
Surface it to the person, too. "Too many attempts, try again in five minutes" is a sentence someone can act on; a generic failure sends them to support.
Choosing values
Raise them when legitimate traffic is being caught: shared networks, a mobile app that retries aggressively, or an environment used for load testing.
Lower Sign-ins and Lookups when the project is a target. Those two are where
an attacker learns something — one tests credentials, the other tests which
accounts exist.
Leave Token refreshes generous. It is the one an ordinary session hits on its
own, and throttling it signs people out mid-use.
Rate limits are not the whole defence
Throttling slows an attacker down; it does not stop one who is patient or distributed. Pair it with multi-factor authentication and the bot check, which reject rather than delay.
Sends are limited separately
Email and SMS have their own quotas, per channel and per environment — a different mechanism with a different failure. See Communications.