Troubleshooting Rate-Limit Exceeded During Authentication in Auth0
Last Updated:
Overview
During some login attempts, the following error is generated and displayed for the user:
invalid_request: You've exceeded the rate limit for /u/login/identifier. Please try again in a short while.
This can be reproduced by starting a normal login attempt. Once the Login prompt is shown (use the New Universal Login experience), reload the page repeatedly until the error message is generated.
Applies To
- Auth0
- Rate Limits
- New Universal Login
Cause
The rate limit for the authentication API was exceeded. There are a few possibilities:
- Global limit exceeded.
- Limit for a specific login session exceeded.
- Limit per IP exceeded.
"/u/login/identifier" and other prompts are affected by the authentication API global limit.
Rate limits are on the Universal Login Prompts to ensure stability and consistency across the platform. The values that apply to both production and development tenants are:
- Page loads: up to 10 per minute.
- Login submissions: up to 5 per minute.
The above limits are applied per transaction and per IP, not globally. Limits are enforced per screen displayed to users. By tracking each unique login attempt, Auth0 ensures that limits from one transaction will not interfere with a new one. This also protects transactions from users sharing the same office network since there will be different limits for every user, which allows Auth0 to have low limits that provide more protection.
Solution
Waiting until the Rate-Limits are refreshed and trying again should resolve the error. If the issue persists, see which action is using up the global API limit.
- These limits are not customizable.
- This limit does not affect other users in the tenant, so a single user will only affect their own Rate-Limits. It will only prevent that user from making multiple calls to the same endpoint.
To understand the root cause of the rate limits, enable the Risk Assessment option in the Bot Detection feature. This will help to generate the Pre-login risk assessment logs with the log type "pla". An extensive number of these logs for an IP will lead to rate-limited requests.
