Auth0 Login Fails with "Too many failed codes. Wait for some minutes before retrying" Error Due to MFA OTP Rate Limit"

This article addresses an error that occurs after multiple failed OTP (One-Time Password) login attempts for Multifactor Authentication (MFA). After several incorrect attempts, the following error is displayed:

Too many failed codes. Wait for some minutes before retrying.

Tenant logs may also show the error: Too Many Failures (gd_otp_rate_limit_exceed).

• Multifactor Authentication (MFA)
• One Time Password (OTP)
• SMS code
• Failed Login
• MFA OTP Limit

This error is triggered as an expected security measure. The system imposes a rate limit that restricts a user to ten incorrect OTP submission attempts. After the tenth failed attempt, the account is temporarily locked to prevent brute-force attacks, and the error message is displayed.

This is expected behavior, and the lockout is temporary. To resolve the issue, the user must wait for the lockout period to expire.

NOTE:

• After 10 failed attempts, the user must wait at least 6 minutes before trying to sign in again.

• If the messaging limit is exceeded, the required wait time increases to 1 hour, after which the user can make 10 more attempts. Refer to the Rate Limit Policy for more information.

• An administrator can customize the error message text. Navigate to Prompts and modify the text for mfa-otp-enrollment-qr, key: too-many-failures. Refer to documentation on how to Customize Universal Login Text Elements for more details.

• When it comes to OTPs sent using Email MFA in particular, this error message can also be generated, and successful attempts are counted alongside failed attempts towards the 10 attempt limit. This behavior may change in the future to count only failed attempts.