Users Blocking Feature Not Working As Expected

Last Updated: Sep 10, 2025

Overview

Hi team,

We're running performance testing on SIT to test the user blocking feature, and we've noticed that Auth0 is blocking the user temporarily, we've executed the following test:
1- We made an automation request for 300 hits to signup API from the same IP Address.
2- We noticed that the response time is high more than (2000ms~) on SIT env
3- All the requests are triggered from the client IP address instead of Akami Adress (success )
4- On the Auth0 dashboard we found the IP 178.20.184.122 blocked status
5- Then we try new bulk requests from the same network
6- most of the requests were passed.

Expected results: the user should be blocked after 100 requests per minute and can't perform any further action.
Actual results: the user has been blocked on Auth0 but he can signup successfully.

Applies To

IP Address
API
Users

Solution

We actually consider the connecting IP address in the request (not the client IP address). The difference between the two is that if the client invokes the signup endpoint behind a proxy server, the proxy server's IP address is counted towards the limit.

The default limit which is applied at the moment is 50 per min/ per tenant/ per connecting IP, the recharge rate for this limit bucket is approximately one signup per second until it's back to 50.