Rate limits

Supabase Auth enforces rate limits on authentication endpoints to prevent abuse. Some rate limits are customizable, and you can configure them in your project Authentication > Rate Limits.

You can also manage rate limits using the Management API:

1
# Get your access token from https://supabase.com/dashboard/account/tokens
2
export SUPABASE_ACCESS_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Get current rate limits
6
curl -X GET "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
7
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
8
  | jq 'to_entries | map(select(.key | startswith("rate_limit_"))) | from_entries'
9
10
# Update rate limits
11
curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
12
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
13
  -H "Content-Type: application/json" \
14
  -d '{
15
    "rate_limit_anonymous_users": 10,
16
    "rate_limit_email_sent": 10,
17
    "rate_limit_sms_sent": 10,
18
    "rate_limit_verify": 10,
19
    "rate_limit_token_refresh": 10,
20
    "rate_limit_otp": 10,
21
    "rate_limit_web3": 10
22
  }'

Rate limit behavior#

Supabase Auth uses a token bucket algorithm for endpoint operations that are limited by IP address.

Most buckets have a maximum capacity of 30 requests. When a bucket is full, brief bursts of up to 30 requests can be allowed in a short period. Anonymous sign-ins are an exception: the bucket capacity matches the configured number of anonymous sign-ins per hour. Once a bucket empties, requests are rate limited until tokens refill. The rate limit defines the rate at which the bucket is refilled.

This means a client that has been idle will tolerate a brief spike in traffic, but sustained requests above the rate limit are denied. When rate limits are exceeded, a 429 Too Many Requests error is returned.

The table below shows the rate limit quotas and additional details for authentication endpoints.

IP address forwarding#

By default, Supabase Auth uses the IP address of the client for rate limiting. In certain cases, such as when using server-side frameworks or proxies in front of a project, it may be necessary to forward the end-user IP address to avoid being rate limited based on the address of the server-side client. To use a forwarded IP address for rate limiting in Supabase Auth, set the Sb-Forwarded-For header to the end-user IP address and make a request with a secret API key. Publishable API keys and legacy anon/service_role API keys are not supported.

IP address forwarding must be explicitly enabled for new projects. You can enable this feature in your project under the IP Address Forwarding section of your project's rate limit settings at Authentication > Rate Limits.

You can also enable IP address forwarding using the management API:

1
# Get your access token from https://supabase.com/dashboard/account/tokens
2
export SUPABASE_ACCESS_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Update IP address forwarding settings
6
curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
7
     -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
8
     -H "Content-Type: application/json" \
9
     -d '{
10
      "security_sb_forwarded_for_enabled": true
11
        }' \
12
    | jq '.security_sb_forwarded_for_enabled'

Once IP address forwarding is enabled, set the Sb-Forwarded-For header using the Supabase SDK:

1
import { createServerClient } from '@supabase/ssr'
2
3
const supabase = createServerClient(
4
  'https://<your-project-id>.supabase.co',
5
  '<your-secret-key>', // Key should start with sb_secret
6
  {
7
    global: {
8
      headers: {
9
        'sb-forwarded-for': request.headers.get('x-forwarded-for'),
10
      },
11
    },
12
  }
13
)