Auth0 generates a maximum API calls exceeded error during failed login attempts involving Post-Login Actions when a single Action exceeds the limit of 100 API calls. Divide the logic into multiple Actions to resolve this error. Auth0 generates this error during certain failed login attempts concerning Post-Login Actions, specifically in cases involving operations with custom claims and attribute assignation.

Maximum number of api.* calls exceeded

The following example shows a typical output of this error occurring in an application:

{
  "action_name": "ActionName",
  "response": {
    "error": {
      "message": "Maximum number of api.* calls exceeded",
      "name": "Error",
      "stack": "Error: Maximum number of api.* calls exceeded\n at exports.onExecutePostLogin (<action_code>:179:20)"
    },
  "stats": { "action_duration_ms": 65 }
  }
}

• Auth0
• API Object
• Post-Login Actions

Auth0 enforces a limit of 100 Action calls on the API object. Auth0 applies this limit per Action, regardless of the purpose of the function or method called, as all api.* calls count toward this limit. This includes operations such as api.idToken.setCustomClaim, api.accessToken.setCustomClaim, and api.samlResponse.setAttribute. Depending on the logic implemented inside an Action, certain loops that heavily utilize api.* operations exceed this limit and trigger the error. Auth0 applies this limit universally across all tenants, and makes no distinction between development and production tenants.

How is the maximum API calls exceeded error resolved?

Auth0 has no future plans to increase or remove this limit on api.* calls. Divide the logic of the failing Post-Login Action into multiple Actions to ensure that no single Action exceeds the limit of 100 API calls by following these steps:

1. Review the Post-Login Action generating the error.
2. Identify the api.* calls.
3. Identify potential loops invoking these api.* calls.
4. Divide the logic into separate Actions to keep the number of api.* calls under 100 per Action.