> ## Documentation Index > Fetch the complete documentation index at: https://docs-staging-chore-rate-limits-autoupdate.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > Rate limits for the Tier 20 (Development) Private Cloud subscription type. # Tier Dev Private Cloud In scenarios with heavy combined load across Authentication and Management APIs, per-API throughput may be lower than advertised maximums. See below for the rate limit policies for the Tier 20 (Development) Private Cloud subscription type. | [API](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#api-rate-limits) | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Authentication API | 20 | 20/second | | [Endpoint](https://auth0.com/docs/api/authentication#introduction) | Method | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | | [User Info](https://auth0.com/docs/api/authentication#get-user-info) | `GET`, `POST` | 10 | 5/minute | To a unique User ID | | [Change Password](https://auth0.com/docs/api/authentication#change-password)

[Reset Password with Universal Login](/docs/authenticate/database-connections/password-change#universal-login-page) | `POST` | 10 | 1/minute | From an IP Address to a unique Email Address | | [Get Passwordless Code or Link](https://auth0.com/docs/api/authentication#passwordless) | `GET`, `POST` | 50 | 50/hour | From an IP Address | | [Native Social Login (Apple / Facebook Only)](https://auth0.com/docs/api/authentication#verify-with-one-time-password-otp-) | `POST` | 50 | 500/minute | Any Request for Apple or Facebook Native Social Login | | [Dynamic Application (Client) Registration](https://auth0.com/docs/api/authentication#dynamic-application-client-registration) | `POST` | 5 | 5/second | Any request | | [Universal Logout](https://auth0.com/docs/api/authentication#global-token-revocation) | `POST` | 35 | 35/second | Any request | | Pushed Authorization Requests (PAR) | `POST` | 100 | 100/second | From an IP Address | | Back-Channel authorize (CIBA) | `POST` | 500 | 500/minute | From an IP Address | | Device code activation (no prompt) | `POST` | 30 | 6/second | From an IP Address | | Device code authorization | `POST` | 5 | 5/second | From an IP Address | | MFA OOB token exchange | `POST` | 12 | 12/minute | To a unique session | | Token Vault ([Connected Accounts](/docs/secure/call-apis-on-users-behalf/token-vault) and [token exchange](/docs/secure/call-apis-on-users-behalf/token-vault#supported-token-exchanges) | `POST` | 10 | 10/second | Any request | | [Cross App Access (ID-JAG exchange)](/docs/ai-agents-mcp/cross-app-access) | `POST` | 10 | 10/second | Any request | \*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read [Suspicious IP Throttling](/docs/secure/attack-protection/suspicious-ip-throttling). | [API](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#api-rate-limits) | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Management API | 20 | 20/second | | [Endpoint](https://auth0.com/docs/api/management/v2) | Method | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------- | | [Read Organizations](https://auth0.com/docs/api/management/v2/organizations/get-organizations) | `GET` | 10 | 100/minute | Any request | | [Read Organizations by ID](https://auth0.com/docs/api/management/v2/organizations/get-organizations-by-id) | `GET` | 40 | 500/minute | Any request | | [Read Organizations by Name](https://auth0.com/docs/api/management/v2/organizations/get-name-by-name) | `GET` | 20 | 200/minute | Any request | | [Write an Organization](https://auth0.com/docs/api/management/v2/organizations/post-organizations) | `POST`, `PATCH`, `DELETE` | 5 | 150/minute | Any request | | [Read Organization Members](https://auth0.com/docs/api/management/v2/organizations/get-organization-members) | `GET` | 40 | 500/minute | Any request | | [Write Organization Members](https://auth0.com/docs/api/management/v2/organizations/post-members) | `POST`, `DELETE` | 20 | 200/minute | Any request | | [Read Members of an Organization](https://auth0.com/docs/api/management/v2/organizations/get-organization-members) | `GET` | 20 | 200/minute | Any request | | [Read Organization Member Roles](https://auth0.com/docs/api/management/v2/organizations/get-organization-member-roles) | `GET` | 20 | 200/minute | Any request | | [Write Organization Member Roles](https://auth0.com/docs/api/management/v2/organizations/post-organization-member-roles) | `POST`, `DELETE` | 20 | 200/minute | Any request | | [Read Organization Connections](https://auth0.com/docs/api/management/v2/organizations/get-enabled-connections) | `GET` | 10 | 100/minute | Any request | | [Write Organization Connections](https://auth0.com/docs/api/management/v2/organizations/post-enabled-connections) | `POST`, `PATCH`, `DELETE` | 5 | 150/minute | Any request | | [Write Custom Domain](https://auth0.com/docs/api/management/v2/custom-domains/post-verify) | `POST` | 5 | 5/minute | Any request | | [Read Status Connection](https://auth0.com/docs/api/management/v2/connections/get-status) | `GET` | 100 | 15/second | Any request | | [Write Signing Keys](https://auth0.com/docs/api/management/v2/keys/post-signing-keys) | `POST` | 5 | 5/day | Any request | | [Read Partials for a Prompt](https://auth0.com/docs/api/management/v2/prompts/get-partials) | `GET` | 5 | 5/minute | Any request | | [Write Partials for a Prompt](https://auth0.com/docs/api/management/v2/prompts/put-partials) | `PUT` | 5 | 5/minute | Any request | | [Read Clients](https://auth0.com/docs/api/management/v2/clients/get-clients)
Only applies to the usage of the `q` parameter. | `GET` | 5 | 150/minute | Any request | | [Read Organization Client Grants](https://auth0.com/docs/api/management/v2/organizations/get-organization-client-grants) | `GET` | 10 | 100/minute | Any request | | [Write Organization Client Grants](https://auth0.com/docs/api/management/v2/organizations/create-organization-client-grants) | `POST` | 5 | 150/minute | Any request | Connection and tenant limits are evaluated in order on every request: the connection limit is checked first, and the tenant limit is only checked if the connection limit is not exceeded. Connection, Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | --------------------------------------------------------------------------------------- | ----------- | --------------- | ------------ | ------------------ | | SCIM API Rate Limit – /scim/v2/connections/\{connection-id} Endpoint (Connection Scope) | 25 | 25 | second | Connection, Tenant | Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | --------------------------------------------------------------------------------- | ----------- | --------------- | ------------ | ------ | | SCIM API Rate Limit – Global, i.e. applies to all SCIM connections (Tenant Scope) | 100 | 100 | second | Tenant | | Endpoint | Method | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | | ------------------------------------ | ------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | | Universal login prompts (global) | `GET`, `POST` | 500 | 500/minute | From an IP Address | | Universal login prompts (per prompt) | `GET` | 20 | 10/minute | From an IP Address and state value. | | Universal login prompts (per prompt) | `POST` | 10 | 5/minute | From an IP Address | | Password reset prompt | `GET` | 500 | 500/minute | From an IP Address | | MFA push enrollment prompt | `GET`, `POST` | 500 | 500/minute | From an IP Address | | MFA push challenge prompt | `GET`, `POST` | 500 | 500/minute | From an IP Address | | MFA SMS enrollment prompt | `GET` | 20 | 10/minute | From an IP Address | | MFA SMS enrollment prompt | `POST` | 10 | 5/minute | From an IP Address | | MFA SMS enrollment verify prompt | `GET` | 20 | 10/minute | From an IP Address | | MFA SMS enrollment verify prompt | `POST` | 10 | 5/minute | From an IP Address | | Passwordless SMS challenge prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Passwordless email challenge prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Phone verification enrollment prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Phone verification challenge prompt | `GET`, `POST` | 5 | 5/minute | From an IP Address | | Device code prompt | `GET`, `POST` | 5 | 5/second | From an IP Address | | Endpoint | [Burst Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | [Sustained Request Limit](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm) | Limit Type | Limit | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ---------- | ------------------- | | OTP (6 numeric digits) failures | 10 | 10 | per hour | To a unique User ID | | Recovery code failures | 10 | 10 | per hour | To a unique User ID | | Webauthn challenge failures | 15 | 15 | per minute | To a unique User ID | | Webauthn challenge generated | 15 | 15 | per minute | To a unique User ID | | Push notifications sent per user | 5 | 5 | per minute | To a unique User ID | | SMS sent per user | 10 | 1 | per hour | To a unique User ID | | Email sent per user | 20 | 1 | per minute | To a unique User ID | Each My Account API endpoint is covered by two rate limit policies: a per-tenant policy (scope: tenant, interval: second) as the primary guard, and a per-user policy (scope: tenant + user, interval: minute) as the secondary guard. A small number of policies are classified as endpoint\_params — they apply only when a specific query parameter is present (e.g. ?type=) and share their physical endpoint with a sibling policy. Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ------------------------------------------------------------------------------- | ----------- | --------------- | ------------ | ------ | | My Account API Rate Limit – Authentication Methods Read (Tenant Scope) | 20 | 20 | second | Tenant | | My Account API Rate Limit – Authentication Methods Read Filtered (Tenant Scope) | 40 | 40 | second | Tenant | | My Account API Rate Limit – Authentication Methods Write (Tenant Scope) | 20 | 20 | second | Tenant | | My Account API Rate Limit – Connected Accounts Create Flow (Tenant Scope) | 1 | 1 | second | Tenant | | My Account API Rate Limit – Connected Accounts Read Accounts (Tenant Scope) | 1 | 1 | second | Tenant | | My Account API Rate Limit – Connected Accounts Read Connections (Tenant Scope) | 1 | 1 | second | Tenant | | My Account API Rate Limit – Connected Accounts Write (Tenant Scope) | 1 | 1 | second | Tenant | | My Account API Rate Limit – Factors Read (Tenant Scope) | 25 | 25 | second | Tenant | | My Account API Rate Limit – Organizations Read (Tenant Scope) | 5 | 5 | second | Tenant | Tenant, User level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ----------------------------------------------------------------------------- | ----------- | --------------- | ------------ | ------------ | | My Account API Rate Limit – Authentication Methods Read (User Scope) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Authentication Methods Read Filtered (User Scope) | 20 | 20 | minute | Tenant, User | | My Account API Rate Limit – Authentication Methods Write (User Scope) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Create Flow (User Scope) | 10 | 10 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Read Accounts (User Scope) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Read Connections (User Scope) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Connected Accounts Write (User Scope) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Factors Read (User Scope) | 5 | 5 | minute | Tenant, User | | My Account API Rate Limit – Organizations Read (User Scope) | 1 | 1 | minute | Tenant, User | Dual-level rate limiting: org bucket (primary, drives response headers) + tenant bucket (secondary ceiling across all orgs in a tenant). Tenant level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ------------------------------------------------------- | ----------- | --------------- | ------------ | ------ | | My Org API Rate Limit – Read Endpoints (Tenant Scope) | 20 | 4 | second | Tenant | | My Org API Rate Limit – Write Endpoints (Tenant Scope) | 10 | 1 | second | Tenant | Organization level: | Resource | Burst Limit | Sustained Limit | Refresh Rate | Scope | | ------------------------------------------------------------- | ----------- | --------------- | ------------ | ------------ | | My Org API Rate Limit – Read Endpoints (Organization Scope) | 4 | 4 | second | Organization | | My Org API Rate Limit – Write Endpoints (Organization Scope) | 4 | 4 | second | Organization |