Authentication API Endpoint Rate Limits

Effective Date: 19 May 2020

Each Authentication API endpoint is configured with a bucket that defines the request limit and rate limit window (per second, per minute, per day, etc.).

bucket:
    size: x
    per_minute: y

For example, the above states that, for the given bucket, there is a maximum request limit of x per minute, and for each minute that elapses, permissions for y requests are added back. In other words, for each 60/y seconds, one additional request is added to the bucket. This occurs automatically until the bucket contains the maximum permitted number of requests.

For some API endpoints, the rate limits are defined per bucket, so the origins of the call do not influence the rate limit changes. For other buckets, the rate limits are defined using different keys, so the originating IP address is considered when counting the number of received API calls.

If you are using an API endpoint not listed below and you receive rate limit headers as part of your response, read Attack Protection for more information.

To ensure Auth0's quality of service, the Authentication API is subject to several levels of rate limiting for free subscribers. Auth0's Authentication API has a global limit of 300 requests per minute for free tenants. The limit is global for the tenant and not per endpoint. The global rate limit applies to all Authentication API endpoints.

The global rate limit applies to all Authentication API endpoints. A complete list of endpoints that are affected by this limit, along with the associated response if the rate limit is exceeded, is a follows:

Private Cloud customer rate limits are specific to your service tier. All values are measured in Requests per Second.

Private cloud has different global limits for the Authentication API, all service specific enterprise rate limits still apply.

If you exceed the rate limit for a given API endpoint, you'll receive an HTTP 429 (Too Many Requests) response. The response will also contain HTTP Response Headers that provide additional information on the rate limits applicable to that endpoint.

If you exceed the global rate limit, the following example log entry will be emitted to your logs: You have reached the global limit for your account. There will be a single log entry per hour while your account exceeds the rate limit. To view the log entries for a subscription, navigate the to Logs page in the Dashboard.

The response body you receive depends on the endpoint. Each endpoint typically provides a return value in a different format (for example, some return an HTTP response, while others redirect to a URL and pass values in the query string). If the endpoint typically provides the response expected as JSON in the HTTP body, then a JSON error response will be sent if a rate limit is reached. To learn more, review the Review HTTP response headers section of our Rate Limit Policy.

The error page response is sent for endpoints that render HTML content to the end user. When you exceed the rate limit, Auth0 renders the error page instead of the expected content.

Endpoints that usually provide JSON-formatted responses will return a JSON object containing an error code and description.

{
  "error": "access_denied or too_many_requests",
  "error_description": "Global rate limit exceeded",
  "error_uri": "https://.../... documentation url"
}

The error you receive depends on the type of endpoint you're calling:

• access_denied: for OAuth endpoints

• too_many_requests: for endpoints that return JSON

XML Errors are returned for endpoints that normally return XML.

<env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope" ...>
 <env:Body>
  <env:Fault>
   <env:Code>
     <env:Value>env:Sender</env:Value>
     <env:Subcode>
      <env:Value>fed:BadRequest or wst:RequestFailed</env:Value>
     </env:Subcode>
   </env:Code>
   <env:Reason>
     <env:Text xml:lang="en">Global rate limit exceeded</env:Text>
   </env:Reason>
   <env:Detail>
   </env:Detail>
  </env:Fault>
 </env:Body>
</env:Envelope>

The error you receive depends on the type of endpoint you're calling:

• fed:BadRequest will be sent for WSFed-related endpoints.

• wst:RequestFailed will be used in for WSTrust-related endpoints.

When you exceed your rate limits, you'll need to reduce the number of calls you make to Auth0. The specifics depend on your use case, but here are some recommendations:

• Cache /.well-known/* responses: This information does not change frequently, so you can usually cache it to reduce the number of times you need to call Auth0.

• Consider requesting an id_token instead of calling /userinfo to get information about the user.

• Reduce bulk calls, such as bulk delete or bulk unlock.

• Entity Limit Policy
• Management API Endpoint Rate Limits
• User/Password Authentication Rate Limits