Rate limits

Rate limits protect your services from abuse

Supabase Auth enforces rate limits on authentication endpoints to prevent abuse. Some rate limits are customizable, and you can configure them in your project Authentication > Rate Limits.

You can also manage rate limits using the Management API:

1
# Get your access token from https://supabase.com/dashboard/account/tokens
2
export SUPABASE_ACCESS_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Get current rate limits
6
curl -X GET "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
7
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
8
  | jq 'to_entries | map(select(.key | startswith("rate_limit_"))) | from_entries'
9
10
# Update rate limits
11
curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
12
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
13
  -H "Content-Type: application/json" \
14
  -d '{
15
    "rate_limit_anonymous_users": 10,
16
    "rate_limit_email_sent": 10,
17
    "rate_limit_sms_sent": 10,
18
    "rate_limit_verify": 10,
19
    "rate_limit_token_refresh": 10,
20
    "rate_limit_otp": 10,
21
    "rate_limit_web3": 10
22
  }'

Rate limit behavior#

Supabase Auth uses a token bucket algorithm for endpoint operations that are limited by IP address.

Each bucket has a maximum capacity of 30 requests. When the bucket is full, brief bursts of up to 30 requests can be allowed in a short period. Once the bucket empties, requests are rate limited until tokens refill. The rate limit defines the rate at which the bucket is refilled.

This means a client that has been idle will tolerate a brief spike in traffic, but sustained request above the rate limit are denied. When rate limits are exceeded, a 429 Too Many Requests error is returned.

The table below shows the rate limit quotas and additional details for authentication endpoints.