mirror of
https://github.com/supabase/supabase.git
synced 2026-10-15 14:19:11 +03:00
107 lines
3.4 KiB
Plaintext
107 lines
3.4 KiB
Plaintext
---
|
|
title = "Auth: over_request_rate_limit"
|
|
topics = ["auth"]
|
|
date_created = "2025-07-07T22:39:54+00:00"
|
|
keywords = ["auth" ]
|
|
|
|
database_id = "031ba6d7-4928-4d95-a2da-bff8dbb740ac"
|
|
|
|
[[errors]]
|
|
http_status_code = 429
|
|
---
|
|
|
|
|
|
The error `over_request_rate_limit` means you violated the rate limits set for a specific path. You can reconfigure your rate limits in the [Auth Dashboard](https://supabase.com/dashboard/project/_/auth/rate-limits) or with the [Management API](https://supabase.com/docs/reference/api/v1-update-auth-service-config).
|
|
|
|
## Rate Limits
|
|
|
|
### Email Sending Limit
|
|
Controls how many authentication-related emails can be sent per hour from your project.
|
|
|
|
- **Default limit**: 2 emails per hour
|
|
> Note: You must set up SMTP to configure this limit.
|
|
|
|
#### Affected paths:
|
|
- /auth/v1/signup
|
|
- /auth/v1/otp
|
|
- /auth/v1/resend
|
|
- /auth/v1/recover
|
|
|
|
### SMS Sending Limit
|
|
Controls how many authentication-related SMS messages can be sent per hour from your project.
|
|
- **Default limit**: 30 SMS messages per hour
|
|
> Note: You must set up SMS to configure this limit.
|
|
|
|
#### Affected paths:
|
|
- /auth/v1/signup
|
|
- /auth/v1/otp
|
|
- /auth/v1/resend
|
|
- /auth/v1/recover
|
|
|
|
### Auth Token Refresh Limit
|
|
Controls the number of sessions that can be refreshed in a _5 minute interval_ per IP address.
|
|
|
|
- **Default limit**: 150 sessions per 5 minute interval
|
|
|
|
#### Affected paths:
|
|
- /auth/v1/resend
|
|
- /auth/v1/otp
|
|
- /auth/v1/recover
|
|
- /auth/v1/token?grant_type=id_token
|
|
- /auth/v1/token?grant_type=refresh_token
|
|
- /auth/v1/signup
|
|
- /auth/v1/token?grant_type=password
|
|
- /auth/v1/user
|
|
- /auth/v1/otp
|
|
- /auth/v1/verify
|
|
- /auth/v1/token?grant_type=pkce
|
|
|
|
### Auth OTP/Magic Link request limit
|
|
Controls the number of OTP/Magic Links an IP can request in a _5 minute interval_.
|
|
|
|
- **Default limit**: 30 OTP/Magic Links per 5 minute interval
|
|
|
|
#### Affected paths:
|
|
- /auth/v1/otp
|
|
- /auth/v1/recover
|
|
|
|
### Auth OTP/Magic Link request limit
|
|
Controls the number of OTP/Magic Links an IP can request in a _5 minute interval_.
|
|
|
|
- **Default limit**: 30 OTP/Magic Links per 5 minute interval
|
|
|
|
#### Affected paths:
|
|
- /auth/v1/otp
|
|
- /auth/v1/recover
|
|
|
|
### Auth anonymous signin request limit
|
|
Controls the number of anonymous signins an IP can request in a _5 minute interval_.
|
|
|
|
- **Default limit**: 30 anonymous signins per 5 minute interval
|
|
> Note: only applies if anonymous signins are enabled in the [Auth Dashboard](https://supabase.com/dashboard/project/_/auth/providers).
|
|
|
|
#### Affected paths:
|
|
- /auth/v1/signup (when used for anonymous signins)
|
|
|
|
|
|
### Rate limit for sign ups and sign ins
|
|
Controls the number of signups and signins an IP can request in a _5 minute interval_ (except for those from anonymous signins)
|
|
|
|
- **Default limit**: 30 signups/signins per 5 minute interval
|
|
|
|
#### Affected paths:
|
|
- /auth/v1/signup
|
|
- /auth/v1/otp
|
|
- /auth/v1/resend
|
|
- /auth/v1/recover
|
|
|
|
|
|
|
|
### Example:
|
|
A user calls `/auth/v1/signup` 31 times in a 5 minute interval. The 31st call will receive a 429 status code.
|
|
|
|
### How to fix it
|
|
- Configure your rate limits in the [Auth Dashboard](https://supabase.com/dashboard/project/_/auth/rate-limits) or with the [Management API](https://supabase.com/docs/reference/api/v1-update-auth-service-config)
|
|
- Check your app to make sure it is not redundantly making requests. This often happens due to
|
|
- accidentally calling the paths during page refreshes
|
|
- accidentally calling the values in a loop, such as one implemented in React's useEffect |