Rate Limit Policies
Frontegg enforces rate limit policies on its APIs to protect your application and user management infrastructure and ensure a seamless user experience. When rate limits are exceeded, Frontegg responds with an HTTP Status Code 429 (Too Many Requests). Your application should handle these responses by checking the status code and implementing a back-off strategy to avoid infinite retry loops.
Limits for Frontegg workspaces
In some cases, the rate limits will be by IP address, and in some cases, they will be by vendor ID.
General rate limits
Note that the general rate limits within every API group refer to all routes within this "group" that are not specified in the table below.
Authentication APIs
| Endpoint | Path | Method | Launch | Scale | Enterprise |
|---|---|---|---|---|---|
| General rate limit | 100/min per IP | 1000/min per IP | 1000/min per IP | ||
| Activate SSO configuration | /identity/resources/sso/v1/:type/activate | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Password reset request | /identity/resources/users/v1/passwords/reset | POST | 5/min per VendorId | 5/min per IP | 10/min per IP |
| Password verification | /identity/resources/users/v1/passwords/reset/verify | POST | 5/min per VendorId | 5/min per IP | 10/min per IP |
| Reset phone number | /identity/resources/users/v1/phone/reset | POST | 5/min per VendorId | 5/min per IP | 10/min per IP |
| Reset phone number verification | /identity/resources/users/v1/phone/reset/verify | POST | 5/min per VendorId | 5/min per IP | 10/min per IP |
| API token (client credentials) authentication | /identity/resources/auth/v1/api-token/resources/auth/v2/api-token | POST | 10/sec per VendorId | 60/sec per VendorId | 100/sec per VendorId |
| API token (client credentials) refresh | /identity/resources/auth/v1/api-token/token/refresh | POST | 10/sec per VendorId | 60/sec per VendorId | 100/sec per VendorId |
| Logout a user (Embedded) | /identity/resources/auth/v1/logout | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| User social authentication (all providers) | /identity/resources/auth/v1/user/sso/:type/postlogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Apple postlogout | /identity/resources/auth/v2/user/sso/apple/postlogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Social dev credentials postlogin | /identity/resources/auth/v2/user/sso/default/:type/postlogin | GET | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Social auth postlogin | /identity/resources/auth/v2/user/sso/:type/postlogin | GET | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Social auth prelogin | /identity/resources/auth/v2/user/sso/default/:type/prelogin | GET | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Login with code postlogin | /identity/resources/auth/v2/user/:type/postlogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Login with code prelogin | /identity/resources/auth/v2/user/sso/:type/prelogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Magic link postlogin | /identity/resources/auth/v1/passwordless/code/postlogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Magic link prelogin | /identity/resources/auth/v1/passwordless/code/prelogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Login with SMS postlogin | /identity/resources/auth/v1/passwordless/magiclink/postlogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Login with SMS prelogin | /identity/resources/auth/v1/passwordless/smscode/prelogin | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Get authentication strategies | /identity/resources/configurations/v1/auth/strategies/public | GET | 10/min per VendorId | 100/min per IP | 1000/min per IP |
| User sign up | /identity/resources/users/v1/signUp | POST | 5/min per VendorId | 10/min per IP | 30/min per IP |
| User password authentication | /identity/resources/auth/v1/user | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| OAuth Token Request | oauth/token | POST | 100/min per VendorId | 100/min per IP | 500/min per IP |
User management APIs
| Endpoint | Path | Method | Launch | Scale | Enterprise |
|---|---|---|---|---|---|
| General Rate Limit | 100/min per IP | 1000/min per IP | 1000/min per IP | ||
| Resend activation email to a user | /idenity/resources/members/v1/:userId/resendActivationEmail | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Create user group | /resources/sso/v1/configurations/:configurationId/groups | POST | 10/min per VendorId | 30/min per IP | 100/min per IP |
| Create tenants in bulk | /resources/migrations/v1/tenants | POST | 10/min per VendorId | 10/min per IP | 30/min per IP |
| Get tenants | /resources/tenants/v1 | GET | 30/min per VendorId | 30/min per IP | 100/min per IP |
| User invitation / creation (V1) | /identity/resources/users/v1 | POST | 30/min per VendorId | 30/min per IP | 150/min per IP |
| User invitation / creation (V2) | /identity/resources/users/v2 | POST | 10/min per VendorId | 30/min per IP | 150/min per IP |
| Delete user | /identity/resources/users/v1/:userId | DELETE | 10/min per VendorId | 10/min per IP | 30/min per IP |
| GET users (V2) | /identity/resources/users/v2 | GET | 30/min per VendorId | 30/min per VendorId | 30/min per VendorId |
| GET users (V3) | /identity/resources/users/v3 | GET | 60/min per VendorId | 100/min per VendorId | 200/min per VendorId |
| GET users with fuzzy search | /identity/resources/users/v1/query/phrase | GET | - | 5/min per VendorId | 10/min per VendorId |
| Assign roles to user | /identity/resources/users/v1/{userId}/roles | POST | 30/min per VendorId | 100/min per IP | 1000/min per IP |
| Set user’s active tenant | /identity/resources/users/v1/{userId}/tenant | POST | 30/min per VendorId | 100/min per IP | 1000/min per IP |
| Remove roles from user | /identity/resources/users/v1/{userId}/roles | DELETE | 30/min per VendorId | 100/min per IP | 1000/min per IP |
Security APIs
| Endpoint | Path | Method | Launch | Scale | Enterprise |
|---|---|---|---|---|---|
| General Rate Limit | |||||
| MFA recovery | /identity/resources/auth/v1/user/mfa/recover | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Generate step up code for user | /identity/resources/auth/v1/user/step-up/generate | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Change password for user | /identity/resources/users/v1/passwords/change | POST | 15/min per IP | 50/min per IP | 50/min per IP |
| Verify user’s MFA enrollment (authenticator app) | /identity/resources/auth/v1/user/mfa/authenticator/enroll/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Verify user’s MFA enrollment (SMS) | /identity/resources/auth/v1/user/mfa/sms/enroll/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Verify user’s MFA enrollment (WebAuthN) | /identity/resources/auth/v1/user/mfa/webauthn/enroll/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Enroll user in MFA (authenticator app) | /identity/resources/auth/v1/user/mfa/authenticator/enroll | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Enroll user in MFA (SMS) | /identity/resources/auth/v1/user/mfa/sms/enroll | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Enroll user in MFA (WebAuthN) | /identity/resources/auth/v1/user/mfa/webauthn/enroll | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Generate MFA code for email | /identity/resources/auth/v1/user/mfa/emailcode | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Add device for MFA via SMS | /identity/resources/auth/v1/user/mfa/sms/:deviceId | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Add device for MFA via deviceId | /identity/resources/auth/v1/user/mfa/webauthn/:deviceId | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Verify device for MFA authentication | /identity/resources/auth/v1/user/mfa/authenticator/:deviceId/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| MFA verification | /identity/resources/auth/v1/user/mfa/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Verify MFA code from email | /identity/resources/auth/v1/user/mfa/emailcode/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Verify device for MFA via SMS | /identity/resources/auth/v1/user/mfa/sms/:deviceId/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
| Verify device for MFA via WebAuthN | /identity/resources/auth/v1/user/mfa/webauthn/:deviceId/verify | POST | 5/min per IP | 10/min per IP | 10/min per IP |
Management APIs
| Endpoint | Path | Method | Launch | Scale | Enterprise |
|---|---|---|---|---|---|
| General rate limit | 100/min per IP | 1000/min per IP | 1000/min per IP | ||
| Update main authentication strategies | /identity/resources/configurations/v1/auth/strategies/main | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Update secondary authentication strategies | /identity/resources/configurations/v1/auth/strategies/secondary | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Create custom social login configuration | /resources/sso/custom/v1 | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Delete custom social login configuration | /resources/sso/custom/v1/:id | DELETE | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Update custom social login configuration | /resources/sso/custom/v1/:id | PATCH | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Get bulk CSV migration errors | /identity/resources/migrations/v1/local/bulk/csv/:migrationId/errors | POST | 2/min per VendorId | 5/min per VendorId | 5/min per VendorId |
| Migrate bulk users via CSV | /identity/resources/migrations/v1/local/bulk/csv | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Migrate bulk users via JSON | /identity/resources/migrations/v1/local/bulk | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Update SSO configuration | /resources/sso/v1 | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Deactivate SSO configuration | /resources/sso/v1/:type/deactivate, /resources/sso/v2/:type/deactivate | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Activate SSO configuration | /resources/sso/v2/:type/activate | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Update SSO configuration | /resources/sso/v2 | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Invite users in bulk (JSON) | /identity/resources/users/bulk/v1/invite | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Identity management settings | /identity/resources/configurations/v1 | POST | 10/min per VendorId | 20/min per VendorId | 20/min per VendorId |
| Check active tenant access tokens | /identity/resources/vendor-only/tenants/access-tokens/v1/active | GET | 20/min per VendorId | 100/min per VendorId | 100/min per VendorId |
| Get tenant access token | /identity/resources/vendor-only/tenants/access-tokens/v1/:id | GET | 20/min per VendorId | 100/min per VendorId | 100/min per VendorId |
| Get user’s active access tokens | /identity/resources/vendor-only/users/access-tokens/v1/active | GET | 20/min per VendorId | 100/min per VendorId | 100/min per VendorId |
| Check active user access tokens | /identity/resources/vendor-only/users/access-tokens/v1/:id | GET | 20/min per VendorId | 100/min per VendorId | 100/min per VendorId |
| Create application | /resources/applications/v1 | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Delete application | /resources/applications/v1/:id | DELETE | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Get application by ID | /resources/applications/v1/:id | GET | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Get applications | /resources/applications/v1 | GET | 15/min per VendorId | 50/min per VendorId | 50/min per VendorId |
| Get default applications | /resources/applications/v1/default | GET | 15/min per VendorId | 50/min per VendorId | 50/min per VendorId |
| Update application by ID | /resources/applications/v1/:id | PATCH | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Assign tenants (accounts) to applications | /resources/applications/tenant-assignments/v1/:appId | POST | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Remove tenant (account) assignment from the application | /resources/applications/tenant-assignments/v1/:appId/:tenantId | DELETE | 5/min per VendorId | 10/min per VendorId | 10/min per VendorId |
| Get tenant assignments for application per ID | /resources/applications/tenant-assignments/v1/:appId | GET | 15/min per VendorId | 50/min per VendorId | 50/min per VendorId |
| Get tenant assignments per application | /resources/applications/tenant-assignments/v1 | GET | 15/min per VendorId | 50/min per VendorId | 50/min per VendorId |
| Vendor authentication | /auth/vendor | POST | 10/sec per IP | 30/sec per IP | 30/sec per IP |
Entitlements APIs
| Endpoint | Method | Launch | Scale | Enterprise |
|---|---|---|---|---|
| General rate limit | 100/min per IP | 1000/min per IP | 1000/min per IP | |
| Create / Update Feature / Plan / FF | 5/min per IP | 10/min per VendorId | 10/min per VendorId | |
| Entitlements (all types) | GET | 100/min per IP | 1000/min per IP | 1000/min per IP |
Rate Limit Headers
It recommended to refer to the below response headers that are returned on all
/identity/routes when optimizing your app to minimize requests and avoid hitting the rate limit:
x-rate-limit-limit
x-rate-limit-remaining
x-rate-limit-reset
Updated about 1 month ago