Private Cloud Basic 100 RPS (1x)

Authentication API: Rate limits for the Authentication API and API endpoints n the Private Cloud Basic 100 RPS (1x) subscription tier.

API	Burst Request Limit	Sustained Request Limit
Authentication API	100	100/second

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
User Info	`GET`, `POST`	10	5/minute	To a unique User ID
Change Password Reset Password with Universal Login	`POST`	10	1/minute	From an IP Address to a unique Email Address
Get Passwordless Code or Link	`GET`, `POST`	50	50/hour	From an IP Address
Native Social Login (Apple / Facebook Only)	`POST`	50	500/minute	Any Request for Apple or Facebook Native Social Login
Dynamic Application (Client) Registration	`POST`	5	5/second	Any request
Universal Logout	`POST`	35	35/second	Any request
Pushed Authorization Requests (PAR)	`POST`	100	100/second	From an IP Address
Back-Channel authorize (CIBA)	`POST`	500	500/minute	From an IP Address
Device code activation (no prompt)	`POST`	30	6/second	From an IP Address
Device code authorization	`POST`	5	5/second	From an IP Address
MFA OOB token exchange	`POST`	12	12/minute	To a unique session
Custom Token Exchange	`POST`	15	15/second	Any request
Token Vault (Connected Accounts and token exchange	`POST`	50	50/second	Any request
On-Behalf-Of Token Exchange	`POST`	30	30/second	Any Request
Cross App Access (ID-JAG exchange)	`POST`	50	50/second	Any Request

*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read Suspicious IP Throttling.

Management API: Rate limits for the Management API, API endpoints, and API endpoint groups in the Private Cloud Basic 100 RPS (1x) subscription.

API	Burst Request Limit	Sustained Request Limit
Management API	50	50/second

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Read Organizations	GET	10	100/minute	Any request
Read Organizations by ID	GET	40	500/minute	Any request
Read Organizations by Name	GET	20	200/minute	Any request
Write an Organization	POST, PATCH, DELETE	5	150/minute	Any request
Read Organization Members	GET	40	500/minute	Any request
Write Organization Members	POST, DELETE	20	200/minute	Any request
Read Members of an Organization	GET	20	200/minute	Any request
Read Organization Member Roles	GET	20	200/minute	Any request
Write Organization Member Roles	POST, DELETE	20	200/minute	Any request
Write Organization Connections	POST, PATCH, DELETE	5	150/minute	Any request
Write Custom Domain	POST	5	5/minute	Any request
Read Status Connection	GET	100	15/second	Any request
Write Signing Keys	POST	5	5/day	Any request
Read Partials for a Prompt	GET	5	5/minute	Any request
Write Partials for a Prompt	PUT	5	5/minute	Any request
Read Clients Only applies to the usage of the `q` parameter.	`GET`	5	150/minute	Any request
Read Organization Client Grants	`GET`	10	100/minute	Any request
Write Organization Client Grants	`POST`	5	150/minute	Any request
Write Token Exchange Profiles	`POST`, `PATCH`, `DELETE`	5	100/minute	Any request
Read Token Exchange Profiles	`GET`	20	200/minute	Any request

SCIM API: Rate limits for the inbound SCIM API endpoints in the Private Cloud Basic 100 RPS (1x) subscription type.

Connection and tenant limits are evaluated in order on every request: the connection limit is checked first, and the tenant limit is only checked if the connection limit is not exceeded.Connection, Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
SCIM API Rate Limit – /scim/v2/connections/{connection-id} Endpoint (Connection Scope) — Private Cloud Basic 100 RPS (1x)	25	25	second	Connection, Tenant

Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
SCIM API Rate Limit – Global, i.e. applies to all SCIM connections (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	100	100	second	Tenant

Endpoint	Method	Burst Request Limit	Sustained Request Limit	Limit Type
Universal login prompts (global)	`GET`, `POST`	500	500/minute	From an IP Address
Universal login prompts (per prompt)	`GET`	20	10/minute	From an IP Address and state value.
Universal login prompts (per prompt)	`POST`	10	5/minute	From an IP Address
Password reset prompt	`GET`	500	500/minute	From an IP Address
MFA push enrollment prompt	`GET`, `POST`	500	500/minute	From an IP Address
MFA push challenge prompt	`GET`, `POST`	500	500/minute	From an IP Address
MFA SMS enrollment prompt	`GET`	20	10/minute	From an IP Address
MFA SMS enrollment prompt	`POST`	10	5/minute	From an IP Address
MFA SMS enrollment verify prompt	`GET`	20	10/minute	From an IP Address
MFA SMS enrollment verify prompt	`POST`	10	5/minute	From an IP Address
Passwordless SMS challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Passwordless email challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Phone verification enrollment prompt	`GET`, `POST`	5	5/minute	From an IP Address
Phone verification challenge prompt	`GET`, `POST`	5	5/minute	From an IP Address
Device code prompt	`GET`, `POST`	5	5/second	From an IP Address

Additional MFA rate limits: Additional MFA rate limits.

Endpoint	Burst Request Limit	Sustained Request Limit	Limit Type	Limit
OTP (6 numeric digits) failures	10	10	per hour	To a unique User ID
Recovery code failures	10	10	per hour	To a unique User ID
Webauthn challenge failures	15	15	per minute	To a unique User ID
Webauthn challenge generated	15	15	per minute	To a unique User ID
Push notifications sent per user	5	5	per minute	To a unique User ID
SMS sent per user	10	1	per hour	To a unique User ID
Email sent per user	20	1	per minute	To a unique User ID

My Account API: Rate limits for the My Account API endpoints in the Private Cloud Basic 100 RPS (1x) subscription type.

Each My Account API endpoint is covered by two rate limit policies: a per-tenant policy (scope: tenant, interval: second) as the primary guard, and a per-user policy (scope: tenant + user, interval: minute) as the secondary guard. A small number of policies are classified as endpoint_params — they apply only when a specific query parameter is present (e.g. ?type=) and share their physical endpoint with a sibling policy.Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Account API Rate Limit – Authentication Methods Read (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	20	20	second	Tenant
My Account API Rate Limit – Authentication Methods Read Filtered (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	40	40	second	Tenant
My Account API Rate Limit – Authentication Methods Write (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	20	20	second	Tenant
My Account API Rate Limit – Connected Accounts Create Flow (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	5	5	second	Tenant
My Account API Rate Limit – Connected Accounts Read Accounts (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	10	10	second	Tenant
My Account API Rate Limit – Connected Accounts Read Connections (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	10	10	second	Tenant
My Account API Rate Limit – Connected Accounts Write (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	5	5	second	Tenant
My Account API Rate Limit – Factors Read (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	25	25	second	Tenant
My Account API Rate Limit – Organizations Read (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	10	10	second	Tenant

Tenant, User level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Account API Rate Limit – Authentication Methods Read (User Scope) — Private Cloud Basic 100 RPS (1x)	5	5	minute	Tenant, User
My Account API Rate Limit – Authentication Methods Read Filtered (User Scope) — Private Cloud Basic 100 RPS (1x)	20	20	minute	Tenant, User
My Account API Rate Limit – Authentication Methods Write (User Scope) — Private Cloud Basic 100 RPS (1x)	5	5	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Create Flow (User Scope) — Private Cloud Basic 100 RPS (1x)	10	10	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Read Accounts (User Scope) — Private Cloud Basic 100 RPS (1x)	5	5	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Read Connections (User Scope) — Private Cloud Basic 100 RPS (1x)	5	5	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Write (User Scope) — Private Cloud Basic 100 RPS (1x)	5	5	minute	Tenant, User
My Account API Rate Limit – Factors Read (User Scope) — Private Cloud Basic 100 RPS (1x)	5	5	minute	Tenant, User
My Account API Rate Limit – Organizations Read (User Scope) — Private Cloud Basic 100 RPS (1x)	5	5	minute	Tenant, User

My Organization API: Rate limits for the My Organization API in the Private Cloud Basic 100 RPS (1x) subscription type.

Dual-level rate limiting: org bucket (primary, drives response headers) + tenant bucket (secondary ceiling across all orgs in a tenant).Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Org API Rate Limit – Read Endpoints (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	40	40	second	Tenant
My Org API Rate Limit – Write Endpoints (Tenant Scope) — Private Cloud Basic 100 RPS (1x)	20	20	second	Tenant

Organization level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Org API Rate Limit – Read Endpoints (Organization Scope) — Private Cloud Basic 100 RPS (1x)	8	8	second	Organization
My Org API Rate Limit – Write Endpoints (Organization Scope) — Private Cloud Basic 100 RPS (1x)	8	4	second	Organization