Authgear
Start BuildingHomePortalCommunity
  • Authgear Overview
  • Get Started
    • 5-Minute Guide
    • Start Building
    • Single-Page App
      • JavaScript (Web)
      • React
      • Angular
      • Vue
    • Native/Mobile App
      • iOS SDK
      • Android SDK
        • Android Kotlin coroutine support
        • Android OKHttp Interceptor Extension (Optional)
      • Flutter SDK
      • React Native SDK
      • Ionic SDK
      • Xamarin SDK
      • Using Authgear without SDK (Client side)
    • Regular Web App
      • Express
      • Next.js
      • Python Flask App
      • Java Spring Boot
      • ASP.NET Core MVC
      • Laravel
      • PHP
    • Backend/API Integration
      • Client SDK to make authorized API calls to backend
      • Validate JWT in your backend
      • Forward Authentication to Authgear Resolver Endpoint
    • AI Coding tools
      • Cursor/Windsurf
    • Integration by OIDC
    • Integration by SAML
      • Use Authgear as SAML Identity Provider for Salesforce
      • Use Authgear as SAML Identity Provider for Dropbox
      • SAML Attribute Mapping
  • Authentication and Access
    • Authentication
      • Add Passkeys Login
      • Add WhatsApp OTP Login
      • Add Email Magic Link Login
      • Add Biometric Login
      • Add Anonymous Users
      • Enable Two-Factor Authentication (2FA)
      • Re-authentication
      • Set Password Expiry
      • Change Forgot/Reset Password settings
      • Add authentication to any web page
    • Single Sign-on Overview
      • App2App Login
      • App2Web (Pre-authenticated URLs)
      • Web2App (From Mobile Apps to Browsers)
      • Force Authgear to Show Login Page
      • Single Sign-on with OIDC
      • Single Sign-on with SAML
    • Social/Enterprise Login Providers Overview
      • Social Login Providers
        • Connect Apps to Apple
        • Connect Apps to Google
        • Connect Apps to Facebook
        • Connect Apps to GitHub
        • Connect Apps to LinkedIn
        • Connect Apps to WeChat
      • Enterprise Login Providers
        • Connect Apps to Azure Active Directory
        • Connect Apps to Microsoft AD FS
        • Connect Apps to Azure AD B2C
      • Force Social/Enterprise Login Providers to Show Login Screen
  • FAQ for Authentication
    • Tips for Apple App Store Review with Passwordless Login
    • Phone Number Validation
    • Skip Login Screen and Direct Users to Enterprise Login
    • Use the OAuth 2.0 State Parameter
    • Local Dev Setup for Connecting to Authgear SaaS in Cookie-based Auth
  • Integration
    • Add custom fields to a JWT Access Token
    • User Profiles
      • What is User Profile
      • Access User Profiles
      • Update User Profiles
      • Profile Custom Attributes
      • Update user profile on sign-up using Hooks
    • Mobile Apps
      • Force authentication on app launch
      • Customize the Login Pop-up / Disable the login alert box
    • Integration with other Software
      • Integrate Authgear with Firebase
      • Integrate with Google Tag Manager
    • FAQ for Integration
      • How to Track User Before and After Signup?
      • What happens with user directly access the Authgear Endpoint?
  • Customization
    • Built-in UI
      • Branding in Auth UI
      • User Settings
      • Privacy Policy & Terms of Service Links
      • Customer Support Link
      • Custom Text
      • Languages and Localization
    • Custom UI
      • Authentication Flow API
      • Implement Authentication Flow API using Express
      • Implement Authentication Flow API using PHP
      • Add Custom Login/Signup UI to Native Apps
      • Manually Link OAuth Provider using Account Management API
      • Implement a custom account recovery UI using Authentication Flow API
    • Custom Domain
    • Custom Email and SMS Templates
    • Custom Email Provider
    • Custom SMS Provider
      • Twilio
      • Webhook/Custom Script
    • Events and Hooks
      • Event List
      • Webhooks
      • JavaScript / TypeScript Hooks
      • Example: Only Allow Signups from Inside the Corporate Network using Hooks
  • Admin & Operations
    • Monitor
      • Audit Log For Users Activities
      • Audit Log for Admin API and Portal
      • Analytics
    • User Management
      • Account Deletion
      • Import Users using User Import API
      • Export Users using the User Export API
      • Manage Users Roles and Groups
      • How to Handle Password While Creating Accounts for Users
    • Migration
      • Bulk migration
      • Rolling migration
      • Zero-downtime migration
  • Security
    • Brute-force Protection
    • Bot Protection
    • Non-HTTP scheme redirect URI
    • Password Strength
  • Reference
    • APIs
      • Admin API
        • Authentication and Security
        • API Schema
        • API Queries and Mutations
        • Using global node IDs
        • Retrieving users using Admin API
        • API Examples
          • Generate OTP code
          • Search for users
          • Update user's picture
          • Update user's standard attributes
      • Authentication Flow API
      • OAuth 2.0 and OpenID Connect (OIDC)
        • Supported Scopes
        • UserInfo
      • User Import API
      • User Export API
    • Tokens
      • JWT Access Token
      • Refresh Token
    • Rate Limits
      • Account Lockout
    • Glossary
    • Billing FAQ
  • Authgear ONCE
    • What is Authgear ONCE
    • Install Authgear ONCE on a VM
    • Install Authgear ONCE on Amazon Web Services (AWS)
    • Install Authgear ONCE on Vultr
  • Concepts
    • Identity Fundamentals
    • Authgear use cases
    • User, Identity and Authenticator
  • Client App SDKs
    • Javascript SDK Reference
    • iOS SDK Reference
    • Android SDK Reference
    • Flutter SDK Reference
    • Xamarin SDK Reference
  • Deployment
    • Run with Docker
    • Deploy with Helm chart
    • Authenticating HTTP request with Nginx
    • Configuration
      • Environment Variables
      • authgear.yaml
      • authgear.secrets.yaml
    • Architecture Guides
      • AWS Reference Architecture
      • Azure Reference Architecture
      • Google Cloud Reference Architecture
      • Throughput Scaling Reference
  • Troubleshooting
    • How to Fix SubtleCrypto: digest() undefined Error in Authgear SDK
    • How to Fix CORS Error
Powered by GitBook
On this page
  • Default Limits
  • Authentication
  • Verification
  • Account Lockout
  • Account Recovery
  • Messaging
  • Default OTP Valid Time
  • Customizing Default Limits

Was this helpful?

Edit on GitHub
Export as PDF
  1. Reference

Rate Limits

Learn about the rate limits for different services and resources.

Authgear protects projects from an unusually high number of requests for services and resources. If a project receives too many requests in a very short period, it is likely to hit the limit. This feature is in place to prevent abuse and keep your application stable.

On this page, you'll find the details about the set limits for all Authgear services and resources.

Default Limits

The following are the default rate limits for any Authgear resource when a limit is not specified in this documentation:

  • 60 requests per IP address in 1 minute (60/min).

  • 10 requests per user per IP address in 1 minute (10/min).

Keep reading to learn more about rate limits for specific resources.

Authentication

The following section contains a table with the rate limits for usage related to authentication.

Limit per IP address: This column specifies the maximum usage of a resource or feature from a single IP address in a specific time interval.

Limit per user per IP: This is the maximum number of usage of a resource or feature for a single user, on a single IP address in a specific time interval. For example, user John.doe@example.com can only use TOTP 10 times in 1 minute from the same IP address.

Item
Limit per IP address
Limit per user per IP

Sign up

7/168hrs (7 days)

N/A

Anonymous Sign up

60/min

N/A

Account Enumeration

10/min

N/A

Password

60/min

10/min

TOTP

60/min

10/min

Passkey

60/min

10/min

SIWE

60/min

10/min

Device Token (Biometric)

60/min

10/min

Verification

The table below shows the rate limits for requests related to user verification.

Trigger per IP: The value under this column specifies the maximum number of user account verification requests that can be started from the same IP address per specific time (1 minute).

Validate per IP: This is the maximum number of user account verifications that can be completed from the same IP address per specific time (1 minute).

Cooldown: The minimum amount of time a user must wait for before they can send another request (retry) or use a feature. The default cooldown for SMS OTP and Email OTP is 60 seconds.

Item
Trigger per IP
Validate per IP
Cooldown

SMS OTP (Passwordless)

60/min

60/min

customizable

Email OTP (Passwordless)

60/min

60/min

customizable

How to Customize Verification Cooldown and Limits

The cooldown for user verification can be set to a custom value in the Authgear Portal. To do this, navigate to Authentication > Login Methods, then click on the Verification tab. You can set the cooldown (in seconds) in the Verification tab window using the Resend Cooldown Duration input field.

Other limits you can set from the Verification tab include:

  • Daily 6-digit OTP limit per user: Sets the maximum number of OTP a user can request in 24 hours.

  • 6-digit OTP valid duration (seconds): The validity of an OTP code sent to a user. Authgear will no longer accept a code after the number of seconds specified here has passed since the user requested the OTP.

  • Number of attempts allowed for 6-digit OTP: This feature is turned off by default. When turned on, a valid OTP will become invalid after a user enters the wrong codes for the specified number of attempts.

Account Lockout

Account lockout is a temporary lock on a user due to them entering a wrong password, OTP, or recovery code more than the maximum number of attempts allowed.

For details about enabling and customizing account lockout, see the account lockout documentation page.

Account Recovery

The table below shows rate limits for sending account recovery messages to users. It also includes a Validate per IP column, that specifies the number of times a user on an IP address can attempt account recovery within a given period.

Trigger per IP: The value under this column specifies the maximum number of account recovery requests that can be started from the same IP address per specific time (1 minute).

Validate per IP: This is the maximum number of account recoveries that can be attempted or completed from the same IP address per specific time (1 minute).

Cooldown per target: The minimum amount of time a user must wait before they can send another request to the same target (email address or phone number).

Item
Trigger per IP
Validate per IP
cooldown per target

Email

Disabled

60/min

1 minute

SMS

Disabled

60/min

1 minute

Messaging

The rate limits under this section apply to all messages (email and SMS) your Authgear project sends.

Limit per IP: This column defines the maximum number of messages that can be initiated from the same IP address per specific time. For example, a user can send a maximum of 200 messages in 1 minute without changing their IP address.

Limit per target: This is the maximum number of messages that can be sent to a target (email address or phone number) per specific time (24 hours). For example, an Authgear project with a Limit per target of 50/24hrs can send a maximum of 50 messages to the same email address in 24 hours.

Item
Limit per IP
Limit per target

Email

200/min

50/24hrs

SMS

60/min

10/hr

Default OTP Valid Time

  • The default valid time for a 6-digit One-time password (OTP) is 5 minutes.

  • For one-time verification links, the default valid time is 20 minutes.

Customizing Default Limits

Where the default rate limits do not work for your specific use case, you can contact us for further discussions on customizing the default limits for your project.

PreviousRefresh TokenNextAccount Lockout

Last updated 7 days ago

Was this helpful?