> ## Documentation Index > Fetch the complete documentation index at: https://docs-dev-chore-rate-limits-autoupdate.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > Tier 100 RPS Private Cloud rate limits # Private Cloud Basic 100 RPS (1x) In scenarios with heavy combined load across Authentication and Management APIs, per-API throughput may be lower than advertised maximums. See below for the rate limits in the Private Cloud Basic 100 RPS (1x) subscription type. These limits apply to each tenant you create in the private cloud environment. Therefore, we recommend deploying one tenant per private cloud environment for risk mitigation. | [API](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#api-rate-limits) | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Authentication API | 100 | 100/second | | [Endpoint](https://auth0.com/docs/api/authentication#introduction) | Method | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | | [User Info](https://auth0.com/docs/api/authentication#get-user-info) | `GET`, `POST` | 10 | 5/minute | To a unique User ID | | [Change Password](https://auth0.com/docs/api/authentication#change-password)

[Reset Password with Universal Login](/docs/authenticate/database-connections/password-change#universal-login-page) | `POST` | 10 | 1/minute | From an IP Address to a unique Email Address | | [Get Passwordless Code or Link](https://auth0.com/docs/api/authentication#passwordless) | `GET`, `POST` | 50 | 50/hour | From an IP Address | | [Native Social Login (Apple / Facebook Only)](https://auth0.com/docs/api/authentication#verify-with-one-time-password-otp-) | `POST` | 50 | 500/minute | Any Request for Apple or Facebook Native Social Login | | [Dynamic Application (Client) Registration](https://auth0.com/docs/api/authentication#dynamic-application-client-registration) | `POST` | 5 | 5/second | Any request | | [Universal Logout](https://auth0.com/docs/api/authentication#global-token-revocation) | `POST` | 35 | 35/second | Any request | | Pushed Authorization Requests (PAR) | `POST` | 100 | 100/second | From an IP Address | | Back-Channel authorize (CIBA) | `POST` | 500 | 500/minute | From an IP Address | | Device code activation (no prompt) | `POST` | 30 | 6/second | From an IP Address | | Device code authorization | `POST` | 5 | 5/second | From an IP Address | | MFA OOB token exchange | `POST` | 12 | 12/minute | To a unique session | | [Custom Token Exchange](/docs/authenticate/custom-token-exchange) | `POST` | 15 | 15/second | Any request | | Token Vault ([Connected Accounts](/docs/secure/call-apis-on-users-behalf/token-vault) and [token exchange](/docs/secure/call-apis-on-users-behalf/token-vault#supported-token-exchanges) | `POST` | 50 | 50/second | Any request | | [On-Behalf-Of Token Exchange](/docs/secure/call-apis-on-users-behalf/on-behalf-of-token-exchange) | `POST` | 30 | 30/second | Any Request | | [Cross App Access (ID-JAG exchange)](/docs/ai-agents-mcp/cross-app-access) | `POST` | 50 | 50/second | Any Request | \*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read Suspicious IP Throttling. | [API](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#api-rate-limits) | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Management API | 50 | 50/second | | [Endpoint](https://auth0.com/docs/api/management/v2) | Method | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------- | | [Read Organizations](https://auth0.com/docs/api/management/v2/organizations/get-organizations) | GET | 10 | 100/minute | Any request | | [Read Organizations by ID](https://auth0.com/docs/api/management/v2/organizations/get-organizations-by-id) | GET | 40 | 500/minute | Any request | | [Read Organizations by Name](https://auth0.com/docs/api/management/v2/organizations/get-name-by-name) | GET | 20 | 200/minute | Any request | | [Write an Organization](https://auth0.com/docs/api/management/v2/organizations/post-organizations) | POST, PATCH, DELETE | 5 | 150/minute | Any request | | [Read Organization Members](https://auth0.com/docs/api/management/v2/organizations/get-organization-members) | GET | 40 | 500/minute | Any request | | [Write Organization Members](https://auth0.com/docs/api/management/v2/organizations/post-members) | POST, DELETE | 20 | 200/minute | Any request | | [Read Members of an Organization](https://auth0.com/docs/api/management/v2/organizations/get-organization-members) | GET | 20 | 200/minute | Any request | | [Read Organization Member Roles](https://auth0.com/docs/api/management/v2/organizations/get-organization-member-roles) | GET | 20 | 200/minute | Any request | | [Write Organization Member Roles](https://auth0.com/docs/api/management/v2/organizations/post-organization-member-roles) | POST, DELETE | 20 | 200/minute | Any request | | [Write Organization Connections](https://auth0.com/docs/api/management/v2/organizations/post-enabled-connections) | POST, PATCH, DELETE | 5 | 150/minute | Any request | | [Write Custom Domain](https://auth0.com/docs/api/management/v2/custom-domains/post-verify) | POST | 5 | 5/minute | Any request | | [Read Status Connection](https://auth0.com/docs/api/management/v2/connections/get-status) | GET | 100 | 15/second | Any request | | [Write Signing Keys](https://auth0.com/docs/api/management/v2/keys/post-signing-keys) | POST | 5 | 5/day | Any request | | [Read Partials for a Prompt](https://auth0.com/docs/api/management/v2/prompts/get-partials) | GET | 5 | 5/minute | Any request | | [Write Partials for a Prompt](https://auth0.com/docs/api/management/v2/prompts/put-partials) | PUT | 5 | 5/minute | Any request | | [Read Clients](https://auth0.com/docs/api/management/v2/clients/get-clients)
Only applies to the usage of the `q` parameter. | `GET` | 5 | 150/minute | Any request | | [Read Organization Client Grants](https://auth0.com/docs/api/management/v2/organizations/get-organization-client-grants) | `GET` | 10 | 100/minute | Any request | | [Write Organization Client Grants](https://auth0.com/docs/api/management/v2/organizations/create-organization-client-grants) | `POST` | 5 | 150/minute | Any request | | [Write Token Exchange Profiles](/docs/authenticate/custom-token-exchange/configure-custom-token-exchange#create-custom-token-exchange-profile) | `POST`, `PATCH`, `DELETE` | 5 | 100/minute | Any request | | [Read Token Exchange Profiles](/docs/authenticate/custom-token-exchange/configure-custom-token-exchange#manage-custom-token-exchange-profile) | `GET` | 20 | 200/minute | Any request | Connection and tenant limits are evaluated in order on every request: the connection limit is checked first, and the tenant limit is only checked if the connection limit is not exceeded. Connection, Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | -------------------------------------------------------------------------------------------------------------------------- | ----------- | --------------- | ------------ | ------------------ | | SCIM API Rate Limit – /scim/v2/connections/\{connection-id} Endpoint (Connection Scope) — Private Cloud Basic 100 RPS (1x) | 25 | 25 | second | Connection, Tenant | Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | -------------------------------------------------------------------------------------------------------------------- | ----------- | --------------- | ------------ | ------ | | SCIM API Rate Limit – Global, i.e. applies to all SCIM connections (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 100 | 100 | second | Tenant | | Endpoint | Method | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | | ------------------------------------ | ------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | | Universal login prompts (global) | `GET`, `POST` | 500 | 500/minute | From an IP Address | | Universal login prompts (per prompt) | `GET` | 20 | 10/minute | From an IP Address and state value. | | Universal login prompts (per prompt) | `POST` | 10 | 5/minute | From an IP Address | | Password reset prompt | `GET` | 500 | 500/minute | From an IP Address | | MFA push enrollment prompt | `GET`, `POST` | 500 | 500/minute | From an IP Address | | MFA push challenge prompt | `GET`, `POST` | 500 | 500/minute | From an IP Address | | MFA SMS enrollment prompt | `GET` | 20 | 10/minute | From an IP Address | | MFA SMS enrollment prompt | `POST` | 10 | 5/minute | From an IP Address | | MFA SMS enrollment verify prompt | `GET` | 20 | 10/minute | From an IP Address | | MFA SMS enrollment verify prompt | `POST` | 10 | 5/minute | From an IP Address | | Passwordless SMS challenge prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Passwordless email challenge prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Phone verification enrollment prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Phone verification challenge prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Device code prompt | `GET`, `POST` | 5 | 5/second | From an IP Address | | Endpoint | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | Limit | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ---------- | ------------------- | | OTP (6 numeric digits) failures | 10 | 10 | per hour | To a unique User ID | | Recovery code failures | 10 | 10 | per hour | To a unique User ID | | Webauthn challenge failures | 15 | 15 | per minute | To a unique User ID | | Webauthn challenge generated | 15 | 15 | per minute | To a unique User ID | | Push notifications sent per user | 5 | 5 | per minute | To a unique User ID | | SMS sent per user | 10 | 1 | per hour | To a unique User ID | | Email sent per user | 20 | 1 | per minute | To a unique User ID | Each My Account API endpoint is covered by two rate limit policies: a per-tenant policy (scope: tenant, interval: second) as the primary guard, and a per-user policy (scope: tenant + user, interval: minute) as the secondary guard. A small number of policies are classified as endpoint\_params — they apply only when a specific query parameter is present (e.g. ?type=) and share their physical endpoint with a sibling policy. Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ------------------------------------------------------------------------------------------------------------------ | ----------- | --------------- | ------------ | ------ | | My Account API Rate Limit – Authentication Methods Read (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 20 | 20 | second | Tenant | | My Account API Rate Limit – Authentication Methods Read Filtered (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 40 | 40 | second | Tenant | | My Account API Rate Limit – Authentication Methods Write (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 20 | 20 | second | Tenant | | My Account API Rate Limit – Connected Accounts Create Flow (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | second | Tenant | | My Account API Rate Limit – Connected Accounts Read Accounts (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 10 | 10 | second | Tenant | | My Account API Rate Limit – Connected Accounts Read Connections (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 10 | 10 | second | Tenant | | My Account API Rate Limit – Connected Accounts Write (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | second | Tenant | | My Account API Rate Limit – Factors Read (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 25 | 25 | second | Tenant | | My Account API Rate Limit – Organizations Read (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 10 | 10 | second | Tenant | Tenant, User level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ---------------------------------------------------------------------------------------------------------------- | ----------- | --------------- | ------------ | ------------ | | My Account API Rate Limit – Authentication Methods Read (User Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Authentication Methods Read Filtered (User Scope) — Private Cloud Basic 100 RPS (1x) | 20 | 20 | minute | Tenant, User | | My Account API Rate Limit – Authentication Methods Write (User Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Create Flow (User Scope) — Private Cloud Basic 100 RPS (1x) | 10 | 10 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Read Accounts (User Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Read Connections (User Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Write (User Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Factors Read (User Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Organizations Read (User Scope) — Private Cloud Basic 100 RPS (1x) | 5 | 5 | minute | Tenant, User | Dual-level rate limiting: org bucket (primary, drives response headers) + tenant bucket (secondary ceiling across all orgs in a tenant). Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ------------------------------------------------------------------------------------------ | ----------- | --------------- | ------------ | ------ | | My Org API Rate Limit – Read Endpoints (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 40 | 40 | second | Tenant | | My Org API Rate Limit – Write Endpoints (Tenant Scope) — Private Cloud Basic 100 RPS (1x) | 20 | 20 | second | Tenant | Organization level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ------------------------------------------------------------------------------------------------ | ----------- | --------------- | ------------ | ------------ | | My Org API Rate Limit – Read Endpoints (Organization Scope) — Private Cloud Basic 100 RPS (1x) | 8 | 8 | second | Organization | | My Org API Rate Limit – Write Endpoints (Organization Scope) — Private Cloud Basic 100 RPS (1x) | 8 | 4 | second | Organization |