Private Cloud Performance 10,000 RPS (100x)

Authentication API: Rate limits for the Authentication API and API endpoints in the Private Cloud Performance 10000 RPS subscription type.

API	Burst Request Limit	Sustained Request Limit	Peak Request Limit
Authentication API	10,000	10,000/second	N/A

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
User Info	`GET`, `POST`	10	5/minute	To a unique User ID
Change Password Reset Password with Universal Login	`POST`	10	1/minute	From an IP Address to a unique Email Address
Get Passwordless Code or Link	`GET`, `POST`	50	50/hour	From an IP Address
Native Social Login (Apple / Facebook Only)	`POST`	50	500/minute	Any Request for Apple or Facebook Native Social Login
Dynamic Application (Client) Registration	`POST`	5	5/second	Any request
Universal Logout	`POST`	2500	2500/second	Any request
Pushed Authorization Requests (PAR)	`POST`	100	100/second	From an IP Address
Back-Channel authorize (CIBA)	`POST`	500	500/minute	From an IP Address
Device code activation (no prompt)	`POST`	30	6/second	From an IP Address
Device code authorization	`POST`	5	5/second	From an IP Address
MFA OOB token exchange	`POST`	12	12/minute	To a unique session
Custom Token Exchange	`POST`	1500	1500/second	Any request
Token Vault (Connected Accounts and token exchange	`POST`	700	700/second	Any request
On-Behalf-Of Token Exchange	`POST`	3000	3000/second	Any Request

*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read Suspicious IP Throttling.

Management API: Rate limits for the Management API, API endpoints, and API endpoint groups in the Private Cloud Performance 10,000 RPS subscription type.

API	Burst Request Limit	Sustained Request Limit
Management API	5000	5000/second

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Organizations	`GET`	1,000	10,000/minute	Any request
Read Organizations by ID	`GET`	4,000	50,000/minute	Any request
Read Organizations by Name	`GET`	2,000	20,000/minute	Any request
Write an Organization	`POST`, `PATCH`, `DELETE`	500	15,000/minute	Any request
Read Organization Members	`GET`	4,800	60,000/minute	Any request
Write Organization Members	`POST`, `DELETE`	2,400	24,000/minute	Any request
Read Members of an Organization	`GET`	2,400	24,000/minute	Any request
Read Organization Member Roles	`GET`	2,400	24,000/minute	Any request
Write Organization Member Roles	`POST`, `DELETE`	2,400	24,000/minute	Any request
Read Organization Connections	`GET`	1,200	12,000/minute	Any request
Write Organization Connections	`POST`, `PATCH`, `DELETE`	600	18,000/minute	Any request
Write Custom Domain	`POST`	5	5/minute	Any request
Write Status Connection	`POST`	100	15/second	Any request
Write Signing Keys	`POST`	5	5/day	Any request
Write Token Exchange Profiles	`POST`, `PATCH`, `DELETE`	15	300/minute	Any request
Read Token Exchange Profiles	`GET`	2000	20000/minute	Any request

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Universal login prompts (global)	`GET`, `POST`	500	500/minute	From an IP Address
Universal login prompts (per prompt)	`GET`	20	10/minute	From an IP Address and state value.
Universal login prompts (per prompt)	`POST`	10	5/minute	From an IP Address
Password reset prompt	`GET`	500	500/minute	From an IP Address
MFA push enrollment prompt	`GET`, `POST`	500	500/minute	From an IP Address
MFA push challenge prompt	`GET`, `POST`	500	500/minute	From an IP Address
MFA SMS enrollment prompt	`GET`	20	10/minute	From an IP Address
MFA SMS enrollment prompt	`POST`	10	5/minute	From an IP Address
MFA SMS enrollment verify prompt	`GET`	20	10/minute	From an IP Address
MFA SMS enrollment verify prompt	`POST`	10	5/minute	From an IP Address
Passwordless SMS challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Passwordless email challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Phone verification enrollment prompt	`GET`, `POST`	5	5/minute	From an IP Address
Phone verification challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Device code prompt	`GET`, `POST`	5	5/second	From an IP Address

Additional MFA rate limits: Additional MFA rate limits.

Endpoint	Burst Request Limit	Sustained Request Limit	Limit Type	Limit
OTP (6 numeric digits) failures	10	10	per hour	To a unique User ID
Recovery code failures	10	10	per hour	To a unique User ID
Webauthn challenge failures	15	15	per minute	To a unique User ID
Webauthn challenge generated	15	15	per minute	To a unique User ID
Push notifications sent per user	5	5	per minute	To a unique User ID
SMS sent per user	10	1	per hour	To a unique User ID
Email sent per user	20	1	per minute	To a unique User ID

My Account API: Rate limits for the My Account API endpoints in the Private Cloud Performance 10,000 RPS (100x) subscription type.

Tenant Level:

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Authentication Methods	`GET`	2000	2000/second	Any request
Write Authentication Methods	`POST`, `PUT`, `DELETE`	2000	2000/second	Any request
Read Authentication Methods (filtered)	`GET`	4000	4000/second	Any request

User Level:

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Authentication Methods	`GET`	5	5/minute	To a unique User ID
Write Authentication Methods	`POST`, `PUT`, `DELETE`	5	5/minute	To a unique User ID
Read Authentication Methods (filtered)	`GET`	20	20/minute	To a unique User ID