Free - Auth0 Docs

Authentication API: Rate limits for the Authentication API and API endpoints in the Free subscription type.

API	Burst Request Limit	Sustained Request Limit
Authentication API	300	300/minute

Endpoint	Method	Path	Burst Request Limit	Sustained Request Limit	Limit Type
User Info	GET, POST	`/userinfo`	10	5 per/min	To a unique user ID
Change Password	POST	`/dbconnections/change_password` & `u/reset-password/request/:connection`	10	1 per/min	From an IP address to a unique email address
Get Passwordless Code or Link	GET, POST	`/passwordless/start`	50	50 per/hr	From an IP address
Get Token	POST	`/oauth/token`	30	30 per/sec	Any request
Cross Origin Authentication	POST	`co/authenticate`	5	5 per/sec	Any request
Authentication	POST	`/usernamepassword/login`	5	5 per/sec	Any request
JSON Web Token Keys	GET	`/.well-known/jwks.json`	20	20 per/sec	Any request
Native Social Login	POST	`/oauth/token`	50	50 per/min	Any Request for Apple or Facebook Native Social Login
Dynamic Application (Client) Registration	POST	`/oidc/register`	5	5 per/sec	Any request
On-Behalf-Of Token Exchange	POST	`/oauth/token`	2	2 per/sec	Any request
Cross App Access (ID-JAG exchange)	POST	`/oauth/token`	5	5 per/sec	Any request

*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read Suspicious IP Throttling.

Management API: Rate limits for the Management API on the Free subscription tier.

API	Burst Request Limit	Sustained Request Limit
Management	2	2/second

Endpoint	Method	Path	Burst Request Limit	Sustained Request Limit	Limit Type
Register Dynamic Client	POST	`/oidc/register`	5	5/second	Any request
Verify Custom Domain	POST	`/api/v2/custom-domains{id}/verify`	5	5/minute	Any request
Read Status Connection	POST	`/api/v2/connections/{id}/status`	100	15/second	Any request
Rotate Signing Keys	POST	`/api/v2/keys/signing/rotate`	5	5/day	Any request
Configure email templates	POST, PATCH, DELETE	`/api/v2/email-templates`	5	25/minute	Any request
Read email templates	GET	`/api/v2/email-templates`	10	50/minute	Any request
Configure email provider	POST, PATCH, DELETE	`/api/v2/emails/provider`	5	25/minute	Any request
Read email provider	GET	`/api/v2/emails/provider`	5	25/minute	Any request

My Account API: Rate limits for the My Account API endpoints in the Free subscription type.

Each My Account API endpoint is covered by two rate limit policies: a per-tenant policy (scope: tenant, interval: second) as the primary guard, and a per-user policy (scope: tenant + user, interval: minute) as the secondary guard. A small number of policies are classified as endpoint_params — they apply only when a specific query parameter is present (e.g. ?type=) and share their physical endpoint with a sibling policy.Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Account API Rate Limit – Authentication Methods Read (Tenant Scope)	2	2	second	Tenant
My Account API Rate Limit – Authentication Methods Read Filtered (Tenant Scope)	5	5	second	Tenant
My Account API Rate Limit – Authentication Methods Write (Tenant Scope)	2	2	second	Tenant
My Account API Rate Limit – Connected Accounts Create Flow (Tenant Scope)	1	1	second	Tenant
My Account API Rate Limit – Connected Accounts Read Accounts (Tenant Scope)	1	1	second	Tenant
My Account API Rate Limit – Connected Accounts Read Connections (Tenant Scope)	1	1	second	Tenant
My Account API Rate Limit – Connected Accounts Write (Tenant Scope)	1	1	second	Tenant
My Account API Rate Limit – Factors Read (Tenant Scope)	25	25	second	Tenant
My Account API Rate Limit – Organizations Read (Tenant Scope)	5	5	second	Tenant

Tenant, User level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Account API Rate Limit – Authentication Methods Read (User Scope)	2	2	minute	Tenant, User
My Account API Rate Limit – Authentication Methods Read Filtered (User Scope)	5	5	minute	Tenant, User
My Account API Rate Limit – Authentication Methods Write (User Scope)	2	2	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Create Flow (User Scope)	10	10	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Read Accounts (User Scope)	5	5	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Read Connections (User Scope)	5	5	minute	Tenant, User
My Account API Rate Limit – Connected Accounts Write (User Scope)	5	5	minute	Tenant, User
My Account API Rate Limit – Factors Read (User Scope)	5	5	minute	Tenant, User
My Account API Rate Limit – Organizations Read (User Scope)	1	1	minute	Tenant, User

SCIM API: Rate limits for the inbound SCIM API endpoints in Public cloud subscriptions that include Enterprise connections.

Connection and tenant limits are evaluated in order on every request: the connection limit is checked first, and the tenant limit is only checked if the connection limit is not exceeded.Connection, Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
SCIM API Rate Limit – /scim/v2/connections/{connection-id} Endpoint (Connection Scope)	5	5	second	Connection, Tenant

Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
SCIM API Rate Limit – Global, i.e. applies to all SCIM connections (Tenant Scope)	5	5	second	Tenant

My Organization API: Rate limits for the My Organization API in the Free subscription type.

Dual-level rate limiting: org bucket (primary, drives response headers) + tenant bucket (secondary ceiling across all orgs in a tenant).Tenant level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Org API Rate Limit – Read Endpoints (Tenant Scope)	8	4	second	Tenant
My Org API Rate Limit – Write Endpoints (Tenant Scope)	4	2	second	Tenant

Organization level:

Resource	Burst Limit	Sustained Limit	Refresh Rate	Scope
My Org API Rate Limit – Read Endpoints (Organization Scope)	8	4	second	Organization
My Org API Rate Limit – Write Endpoints (Organization Scope)	4	2	second	Organization