Private Cloud Performance 10,000 RPS (100x)

Tier 10000 RPS Private Cloud rate limits

See below for the rate limits in the Private Cloud Performance 10,000 RPS (100x) subscription type.

Therefore, we recommend deploying one tenant per private cloud environment for risk mitigation.

Authentication API: Rate limits for the Authentication API and API endpoints in the Private Cloud Performance 10000 RPS subscription type.

API	Burst Request Limit	Sustained Request Limit	Peak Request Limit
Authentication API	10,000	10,000/second	N/A

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
User Info	GET, POST	10	5/minute	To a unique User ID
Change Password Reset Password with Universal Login	POST	10	1/minute	From an IP Address to a unique Email Address
Get Passwordless Code or Link	GET, POST	50	50/hour	From an IP Address
Native Social Login (Apple / Facebook Only)	POST	50	500/minute	Any Request for Apple or Facebook Native Social Login
Dynamic Application (Client) Registration	POST	5	5/second	Any request
Universal Logout	POST	2500	2500/second	Any request
Pushed Authorization Requests (PAR)	POST	100	100/second	From an IP Address
Back-Channel authorize (CIBA)	POST	500	500/minute	From an IP Address
Device code activation (no prompt)	POST	30	6/second	From an IP Address
Device code authorization	POST	5	5/second	From an IP Address
MFA OOB token exchange	POST	12	12/minute	To a unique session

*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read Suspicious IP Throttling.

Management API: Rate limits for the Management API, API endpoints, and API endpoint groups in the Private Cloud Performance 10,000 RPS subscription type.

API	Burst Request Limit	Sustained Request Limit
Management API	5000	5000/second

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Organizations	GET	1,000	10,000/minute	Any request
Read Organizations by ID	GET	4,000	50,000/minute	Any request
Read Organizations by Name	GET	2,000	20,000/minute	Any request
Write an Organization	POST, PATCH, DELETE	500	15,000/minute	Any request
Read Organization Members	GET	4,800	60,000/minute	Any request
Write Organization Members	POST, DELETE	2,400	24,000/minute	Any request
Read Members of an Organization	GET	2,400	24,000/minute	Any request
Read Organization Member Roles	GET	2,400	24,000/minute	Any request
Write Organization Member Roles	POST, DELETE	2,400	24,000/minute	Any request
Read Organization Connections	GET	1,200	12,000/minute	Any request
Write Organization Connections	POST, PATCH, DELETE	600	18,000/minute	Any request
Write Custom Domain	POST	5	5/minute	Any request
Write Status Connection	POST	100	15/second	Any request
Write Signing Keys	POST	5	5/day	Any request

Universal Login Flow Endpoints: Rate limits for the endpoints utilized for the Universal Login Authentication Flow for all subscription types.

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Universal login prompts (global)	GET, POST	500	500/minute	From an IP Address
Universal login prompts (per prompt)	GET	20	10/minute	From an IP Address and state value.
Universal login prompts (per prompt)	POST	10	5/minute	From an IP Address
Password reset prompt	GET	500	500/minute	From an IP Address
MFA push enrollment prompt	GET, POST	500	500/minute	From an IP Address
MFA push challenge prompt	GET, POST	500	500/minute	From an IP Address
MFA SMS enrollment prompt	GET	20	10/minute	From an IP Address
MFA SMS enrollment prompt	POST	10	5/minute	From an IP Address
MFA SMS enrollment verify prompt	GET	20	10/minute	From an IP Address
MFA SMS enrollment verify prompt	POST	10	5/minute	From an IP Address
Passwordless SMS challenge prompt	GET, POST	5	5/minute	From an IP Address
Passwordless email challenge prompt	GET, POST	5	5/minute	From an IP Address
Phone verification enrollment prompt	GET, POST	5	5/minute	From an IP Address
Phone verification challenge prompt	GET, POST	5	5/minute	From an IP Address
Device code prompt	GET, POST	5	5/second	From an IP Address

Additional MFA rate limits: Additional MFA rate limits.

Endpoint	Burst Request Limit	Sustained Request Limit	Limit Type	Limit
OTP (6 numeric digits) failures	10	10	per hour	To a unique User ID
Recovery code failures	10	10	per hour	To a unique User ID
Webauthn challenge failures	15	15	per minute	To a unique User ID
Webauthn challenge generated	15	15	per minute	To a unique User ID
Push notifications sent per user	5	5	per minute	To a unique User ID
SMS sent per user	10	1	per hour	To a unique User ID
Email sent per user	20	1	per minute	To a unique User ID