Enterprise Rate Limits

Authentication API

Review the following table for Global Authentication API Rate Limits, or the rate limit policy protecting nearly all Authentication API endpoints. Rate limits for the Authentication API and API endpoints in the Enterprise subscription type:

Tenant	Burst Request Limit	Sustained Request Limit
Production	100/second	100/second
Production (2x Public Performance Burst)	200/second for 48/hrs per month	100/second
Production (3x Public Performance Burst)	300/second for 48/hrs per month	100/second
Production (4x Public Performance Burst)	400/second for 48/hrs per month	100/second
Non-production	100/second	100/second

These limits are constrained to 48 hours per month. After 48 hours, these limits revert to product limits. For more information, read Public Performance Burst.

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
User Info	`GET`, `POST`	10	5/minute	To a unique User ID
Change Password	`POST`	10	1/minute	From an IP Address to a unique Email Address
Reset Password with Universal Login	`POST`	10	1/minute	From an IP Address to a unique Email Address
Get Passwordless Code or Link	`GET`, `POST`	50	50/hour	From an IP Address
Native Social Login (Apple / Facebook Only)	`POST`	50	500/minute	Any Request for Apple or Facebook Native Social Login
Dynamic Application (Client) Registration	`POST`	5	5/second	Any request
Universal Logout	`POST`	35	35/second	Any request
Pushed Authorization Requests (PAR)	`POST`	100	100/second	From an IP Address
Back-Channel authorize (CIBA)	`POST`	500	500/minute	From an IP Address
Device code activation (no prompt)	`POST`	30	6/second	From an IP Address
Device code authorization	`POST`	5	5/second	From an IP Address
MFA OOB token exchange	`POST`	12	12/minute	To a unique session
Custom Token Exchange	`POST`	15	15/second	Any request
On-Behalf-Of Token Exchange	`POST`	30	30/second	Any Request

Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read Suspicious IP Throttling.

Management API

Review the following table for Global Management API Rate Limits. Most Management API endpoints, except those listed under “endpoints”, are protected by these rate limit policies. Rate limits for the Management API, API endpoints, and API endpoint groups in the Enterprise subscription type:

Tenant Environment	Burst Request Limit	Sustained Request Limit
Production	50	16/second
Non-production	10	2/second

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Organizations by Name	`GET`	20	200/minute	Any request
Write Organizations	`POST`, `PATCH`, `DELETE`	5	150/minute	Any request
Read Organization Members	`GET`	40	500/minute	Any request
Write Organization Members	`POST`, `DELETE`	20	200/minute	Any request
Read Organization invitation	`GET`	20	200/minute	Any request
Write Organization invitation	`POST`	20	200/minute	Any request
Read Organization Member Roles	`GET`	20	200/minute	Any request
Write Organization Member Roles	`POST`, `DELETE`	20	200/minute	Any request
Read Organization Connections	`GET`	10	100/minute	Any request
Write Organization Connections	`POST`, `PATCH`, `DELETE`	5	150/minute	Any request
Write Custom Domains	`POST`	5	5/minute	Any request
Read Status Connection	`GET`	100	15/second	Any request
Write Signing Keys	`POST`	5	5/day	Any request
Read Partials for a Prompt	`GET`	5	5/minute	Any request
Write Partials for a Prompt	`PUT`	5	5/minute	Any request
Read Clients Only applies to the usage of the `q` parameter.	`GET`	5	150/minute	Any request
Read Organization Client Grants	`GET`	10	100/minute	Any request
Write Organization Client Grants	`POST`	5	150/minute	Any request
Write email templates	`POST`, `PATCH`, `DELETE`	10	100/minute	Any request
Read email templates	`GET`	15	150/minute	Any request
Write email provider	`POST`, `PATCH`, `DELETE`	10	100/minute	Any request
Read email provider	`GET`	15	150/minute	Any request
Write Token Exchange Profiles	`POST`, `PATCH`, `DELETE`	5	100/minute	Any request
Read Token Exchange Profiles	`GET`	20	200/minute	Any request

SCIM API

Rate limits for the inbound SCIM API endpoints in public cloud subscriptions that include Enterprise connections:

Limit Type	Endpoint Path	Operation	Limit
Single SCIM connection endpoint	`/scim/v2/connections/{connection-id}`	Any request	25 requests per second
Global tenant limit for all SCIM connections	`/scim/v2/connections/*`	Any request	100 requests per second

Rate limits for the endpoints utilized for the Universal Login Authentication Flow for all subscription types:

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Universal login prompts (global)	`GET`, `POST`	500	500/minute	From an IP Address
Universal login prompts (per prompt)	`GET`	20	10/minute	From an IP Address and state value.
Universal login prompts (per prompt)	`POST`	10	5/minute	From an IP Address
Password reset prompt	`GET`	500	500/minute	From an IP Address
MFA push enrollment prompt	`GET`, `POST`	500	500/minute	From an IP Address
MFA push challenge prompt	`GET`, `POST`	500	500/minute	From an IP Address
MFA SMS enrollment prompt	`GET`	20	10/minute	From an IP Address
MFA SMS enrollment prompt	`POST`	10	5/minute	From an IP Address
MFA SMS enrollment verify prompt	`GET`	20	10/minute	From an IP Address
MFA SMS enrollment verify prompt	`POST`	10	5/minute	From an IP Address
Passwordless SMS challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Passwordless email challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Phone verification enrollment prompt	`GET`, `POST`	5	5/minute	From an IP Address
Phone verification challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Device code prompt	`GET`, `POST`	5	5/second	From an IP Address

Additional MFA rate limits

Endpoint	Burst Request Limit	Sustained Request Limit	Limit Type	Limit
OTP (6 numeric digits) failures	10	10	per hour	To a unique User ID
Recovery code failures	10	10	per hour	To a unique User ID
Webauthn challenge failures	15	15	per minute	To a unique User ID
Webauthn challenge generated	15	15	per minute	To a unique User ID
Push notifications sent per user	5	5	per minute	To a unique User ID
SMS sent per user	10	1	per hour	To a unique User ID
Email sent per user	20	1	per minute	To a unique User ID

My Account API

Rate limits for the My Account API endpoints in the Enterprise subscription type: Tenant Level:

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Authentication Methods	`GET`	25	25/second	Any request
Write Authentication Methods	`POST`, `PUT`, `DELETE`	25	25/second	Any request
Read Authentication Methods (filtered)	`GET`	100	100/second	Any request

User Level:

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Authentication Methods	`GET`	5	5/minute	To a unique User ID
Write Authentication Methods	`POST`, `PUT`, `DELETE`	5	5/minute	To a unique User ID
Read Authentication Methods (filtered)	`GET`	20	20/minute	To a unique User ID

​Authentication API

​Management API

​SCIM API

​Universal Login Flow Endpoints

​Additional MFA rate limits

​My Account API

Authentication API

Management API

SCIM API

Universal Login Flow Endpoints

Additional MFA rate limits

My Account API