Enterprise

See below for the rate limits in the Enterprise subscription type.

/

Tenant Burst Request Limit Sustained Request Limit
Production 100/second 100/second
Production (2x Public Performance Burst) 200/second for 48/hrs per month 100/second
Production (3x Public Performance Burst) 300/second for 48/hrs per month 100/second
Production (4x Public Performance Burst) 400/second for 48/hrs per month 100/second
Non-production 100/second 100/second

*These limits are constrained to 48 hours per month. After 48 hours, these limits revert to product limits. For more information, see Public Performance Burst.

Endpoint Method Burst Request Limit Sustained Request Limit Limit Type
User Info GET, POST 10 5/minute To a unique User ID
Change Password

Reset Password with Universal Login		 POST 10 1/minute From an IP Address to a unique Email Address
Get Passwordless Code or Link GET, POST 50 50/hour From an IP Address
Native Social Login (Apple / Facebook Only) POST 50 500/minute Any Request for Apple or Facebook Native Social Login
Dynamic Application (Client) Registration POST 5 5/second Any request
Universal Logout POST 35 35/second Any request
Pushed Authorization Requests (PAR) POST 100 100/second From an IP Address
Back-Channel authorize (CIBA) POST 500 500/minute From an IP Address
Device code activation (no prompt) POST 30 6/second From an IP Address
Device code authorization POST 5 5/second From an IP Address
MFA OOB token exchange POST 12 12/minute To a unique session

*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read Suspicious IP Throttling.

/

Tenant Environment Burst Request Limit Sustained Request Limit
Production 50 16/second
Non-production 10 2/second

Endpoint Method Burst Request Limit Sustained Request Limit Limit Type
Read Organizations by Name GET 20 200/minute Any request
Write Organizations POST, PATCH, DELETE 5 150/minute Any request
Read Organization Members GET 40 500/minute Any request
Write Organization Members POST, DELETE 20 200/minute Any request
Read Organization invitation GET 20 200/minute Any request
Read Organization Member Roles GET 20 200/minute Any request
Write Organization Member Roles POST, DELETE 20 200/minute Any request
Read Organization Connections GET 10 100/minute Any request
Write Organization Connections POST, PATCH, DELETE 5 150/minute Any request
Write Custom Domains POST 5 5/minute Any request
Read Status Connection GET 100 15/second Any request
Write Signing Keys POST 5 5/day Any request
Read Partials for a Prompt GET 5 5/minute Any request
Write Partials for a Prompt PUT 5 5/minute Any request
Read Clients


Only applies to the usage of the q parameter.

 GET 5 150/minute Any request
Read Organization Client Grants GET 10 100/minute Any request
Write Organization Client Grants POST 5 150/minute Any request
Write email templates POST, PATCH, DELETE 10 100/minute Any request
Read email templates GET 15 150/minute Any request
Write email provider POST, PATCH, DELETE 10 100/minute Any request
Read email provider GET 15 150/minute Any request

/

Limit Type Endpoint Path Operation Limit
Single SCIM connection endpoint /scim/v2/connections/{connection-id} Any request 25 requests per second
Global tenant limit for all SCIM connections /scim/v2/connections/* Any request 100 requests per second

/

Endpoint Method Burst Request Limit Sustained Request Limit Limit Type
Universal login prompts (global) GET, POST 500 500/minute From an IP Address
Universal login prompts (per prompt) GET 20 10/minute From an IP Address
Universal login prompts (per prompt) POST 10 5/minute From an IP Address
Password reset prompt GET 500 500/minute From an IP Address
MFA push enrollment prompt GET, POST 500 500/minute From an IP Address
MFA push challenge prompt GET, POST 500 500/minute From an IP Address
MFA SMS enrollment prompt GET 20 10/minute From an IP Address
MFA SMS enrollment prompt POST 10 5/minute From an IP Address
MFA SMS enrollment verify prompt GET 20 10/minute From an IP Address
MFA SMS enrollment verify prompt POST 10 5/minute From an IP Address
Passwordless SMS challenge prompt GET, POST 5 5/minute From an IP Address
Passwordless email challenge prompt GET, POST 5 5/minute From an IP Address
Phone verification enrollment prompt GET, POST 5 5/minute From an IP Address
Phone verification challenge prompt GET, POST 5 5/minute From an IP Address
Device code prompt GET, POST 5 5/second From an IP Address

/

Endpoint Burst Request Limit Sustained Request Limit Limit Type Limit
OTP (6 numeric digits) failures 10 10 per hour To a unique User ID
Recovery code failures 10 10 per hour To a unique User ID
Webauthn challenge failures 15 15 per minute To a unique User ID
Webauthn challenge generated 15 15 per minute To a unique User ID
Push notifications sent per user 5 5 per minute To a unique User ID
SMS sent per user 10 1 per hour To a unique User ID
Email sent per user 20 1 per minute To a unique User ID