Auth0 Rate Limit Exceeded (429 Too Many Requests)

How to fix it

Try these in order — the most common fix is first.

1. 1. Read the rate limit headers

   1. The 429 message points you to the X-RateLimit-Limit header and related headers; inspect them to see your limit
   Did this fix it? Yes No

2. 2. Reduce calls

   Copy steps
   1. Cut unnecessary repeated logins in app code
   2. Avoid load tests that generate high authentication traffic against production
   3. For SMS MFA limits, wait an hour before retrying
   Did this fix it? Yes No

3. 3. Estimate usage and raise limits

   Copy steps
   1. Each end-user login makes several API calls; estimate with Auth0's Rate Limit Use Cases page
   2. Enterprise plans offer a Public Performance Burst add-on (2x to 4x, up to 48 hours per month)
   Did this fix it? Yes No

Symptoms

API or login calls fail with 429 "Too Many Requests", sometimes surfacing as a CORS error.

Why it happens

• Tenant or endpoint limit exceeded (limits vary by subscription and production vs development tenant)
• Repeated database login attempts: 20 per minute from one IP against the same user, then 10 per minute
• More than 10 SMS MFA messages in one hour
• Load tests or repeated logins generating heavy authentication traffic

This guide also covers

• auth0 rate limit exceeded
• auth0 429 too many requests
• auth0 management api rate limit

The same problem in other apps

All plan limits, paywalls & watermarks guides →

• Supabase Edge Function 546 WORKER_LIMIT Error (Supabase)

Other Auth0 errors

• Auth0 Callback URL Mismatch Error
• Auth0 Invalid State Error
• Auth0 Login Loop: Silent Authentication Not Working
• Auth0 CORS Error
• Auth0 Refresh Token Not Working
• Auth0 invalid_grant Error
• Auth0 Social Login Not Working
• Auth0 MAU Limit & Pricing Jump