Rate limits
How Gatekeep limits signup, recovery, sign-in and token requests, and what your app sees when a limit is hit.
Gatekeep limits how often each IP address and each email address can hit sensitive endpoints. That slows down email bombing, account probing and brute-force guessing.
The limits
| What | Limit |
|---|---|
| Signup and recovery emails, per address | 1 a minute, 5 an hour |
| Signup and recovery requests, per IP | 60 an hour |
| Passkey sign-in attempts, per IP | 60 an hour |
/authorize, /token and sign-in options, per IP | 600 an hour |
/userinfo, per access token | 600 an hour |
When a limit is hit
- Per IP: Gatekeep returns
429 Too Many Requestswith aRetry-Afterheader in seconds. - Per email address: Gatekeep shows the usual “Check your inbox” page but doesn’t send another email. Answering differently would reveal whether an address has an account.
If your users regularly sit behind one shared IP address (a large office or school network), talk to us about higher limits.