Authgear protects projects from an unusually high number of requests for services and resources. If a project receives too many requests in a very short period, it is likely to hit the limit. This feature is in place to prevent abuse and keep your application stable.

On this page, you'll find the details about the set limits for all Authgear services and resources.

Default Limits

The following are the default rate limits for any Authgear resource when a limit is not specified in this documentation:

• 60 requests per IP address in 1 minute (60/min).

• 10 requests per user per IP address in 1 minute (10/min).

Keep reading to learn more about rate limits for specific resources.

Authentication

The following section contains a table with the rate limits for usage related to authentication.

Limit per IP address: This column specifies the maximum usage of a resource or feature from a single IP address in a specific time interval.

Limit per user per IP: This is the maximum number of usage of a resource or feature for a single user, on a single IP address in a specific time interval. For example, user John.doe@example.com can only use TOTP 10 times in 1 minute from the same IP address.

Verification

The table below shows the rate limits for requests related to user verification.

Trigger per IP: The value under this column specifies the maximum number of user account verification requests that can be started from the same IP address per specific time (1 minute).

Validate per IP: This is the maximum number of user account verifications that can be completed from the same IP address per specific time (1 minute).

Cooldown: The minimum amount of time a user must wait for before they can send another request (retry) or use a feature. The default cooldown for SMS OTP and Email OTP is 60 seconds.

How to Customize Verification Cooldown and Limits

The cooldown for user verification can be set to a custom value in the Authgear Portal. To do this, navigate to Authentication > Login Methods, then click on the Verification tab. You can set the cooldown (in seconds) in the Verification tab window using the Resend Cooldown Duration input field.

Other limits you can set from the Verification tab include:

• Daily 6-digit OTP limit per user: Sets the maximum number of OTP a user can request in 24 hours.

• 6-digit OTP valid duration (seconds): The validity of an OTP code sent to a user. Authgear will no longer accept a code after the number of seconds specified here has passed since the user requested the OTP.

• Number of attempts allowed for 6-digit OTP: This feature is turned off by default. When turned on, a valid OTP will become invalid after a user enters the wrong codes for the specified number of attempts.

Account Lockout

Account lockout is a temporary lock on a user due to them entering a wrong password, OTP, or recovery code more than the maximum number of attempts allowed.

For details about enabling and customizing account lockout, see the account lockout documentation page.

Account Recovery

The table below shows rate limits for sending account recovery messages to users. It also includes a Validate per IP column, that specifies the number of times a user on an IP address can attempt account recovery within a given period.

Trigger per IP: The value under this column specifies the maximum number of account recovery requests that can be started from the same IP address per specific time (1 minute).

Validate per IP: This is the maximum number of account recoveries that can be attempted or completed from the same IP address per specific time (1 minute).

Cooldown per target: The minimum amount of time a user must wait before they can send another request to the same target (email address or phone number).

Messaging

The rate limits under this section apply to all messages (email and SMS) your Authgear project sends.

Limit per IP: This column defines the maximum number of messages that can be initiated from the same IP address per specific time. For example, a user can send a maximum of 200 messages in 1 minute without changing their IP address.

Limit per target: This is the maximum number of messages that can be sent to a target (email address or phone number) per specific time (24 hours). For example, an Authgear project with a Limit per target of 50/24hrs can send a maximum of 50 messages to the same email address in 24 hours.

Default OTP Valid Time

• The default valid time for a 6-digit One-time password (OTP) is 5 minutes.

• For one-time verification links, the default valid time is 20 minutes.

Customizing Default Limits

Where the default rate limits do not work for your specific use case, you can contact us for further discussions on customizing the default limits for your project.

Account lockout is a feature that places a temporary lock on a user due to them entering a wrong password, OTP, or recovery code more than the maximum number of attempts allowed.

Account lockout attempts are shared for all supported authenticators. For example, if the maximum attempt for account lockout is 5, a user's account will be locked after they enter the wrong pass 2 times and a wrong recovery code 3 times (2+3 sum up to 5 attempts).

How to Enable Account Lockout

The account lockout feature is not enabled by default. To enable it, in the Authgear Portal, navigate to Authentication > Login Methods. Then go to the Account Lockout Policy tab and toggle the "Enable account lockout policy" radio button.

Once you've enabled the account lockout policy, you can view and configure the various policies that control how the account lockout feature works.

Account Lockout Policies

The following are the different policies you can configure to control how account lockout will work on your Authgear project.

1.0 Lockout Threshold

This section of the account lockout policy is where you can configure the number of failed login attempts your users can make within a time limit before their accounts are locked.

1.1 Failed Login Attempts

The value for Failed Login Attempts is the maximum number of failed attempts to log in a user can make before their account is locked.

1.2 Reset Failed Attempts After (minutes)

This is where you can specify how long after the last failed login attempt that the system should reset the failed login attempt counter. For example, if the value for Failed Login Attempt is 10 and the Reset Failed Attempts After is 1440 minutes, this means the user will get another 10 attempts 24 hours (1440 minutes) after their last failed attempt that did not trigger a lockout.

2.0 Lockout Duration

You can use this section for the account lockout policy to configure the number of minutes an account will remain locked when it has exceeded the lockout threshold.

2.1 Lockout Duration (minutes)

This determines how long the account will remain locked.

2.2 Backoff Factor

The value is a number by which the lockout duration will be multiplied for every subsequent failed attempt. Hence, increasing the lockout duration exponentially. For example, if Backoff Factor is 2, and lockout duration is 1 minute, the lockout duration will increase in the format of 2, 4, 8 minutes, and so on up till the maximum lockout duration.

2.3 Maximum Lockout Duration (minutes)

This is where you set a cap on the lockout duration.

3.0 Lockout Type

This determines whether the account lockout is only applied when the user attempts to log in with the same IP address, or when the user attempts to log in on any devices.

4.0 Apply Policy to Selected Authenticators

Under this section you can select the types of authenticator where failed login attempts will be counted. The available options include:

• Password

• Passwordless via Phone/Email

• Authenticator App (TOTP)

• Recovery codes