Auth0 Multi-Resource Refresh Token Consumes Authentication API Rate Limit Twice
Last Updated:
Overview
Auth0 enforces rate limits on the Authentication API. When an application processes a Multi-Resource Refresh Token (MRRT) for two APIs, the application requests the token exchange endpoint twice. Auth0 processes one exchange for the primary API and another for the secondary API, which consumes the Authentication API rate limit twice.
Applies To
- Auth0
- Multi-Resource Refresh Token (MRRT)
- Application Programming Interface (API)
- Authentication API
- Rate Limits
Solution
Why does a Multi-Resource Refresh Token consume the Authentication API rate limit twice?
Review the following details to understand how an application processes an MRRT and consumes Auth0 rate limits.
- Auth0 enforces rate limits on the Authentication API.
- In an MRRT context involving two APIs, an application requests the token exchange endpoint twice.
- Auth0 processes one token exchange for the primary API and a second token exchange for the secondary API.
- By receiving two requests from the application for the token exchange endpoint, Auth0 consumes the Authentication API rate limit twice.
