rate limits.md
Rate limits
WorkOS APIs are rate limited to ensure that they are fast for everyone. If you find yourself getting 429 errors, double check your integration to make sure you aren't making unnecessary requests.
General
| Name | Path | Limit |
|---|---|---|
| All requests | * | 6,000 requests per 60 seconds per API key |
This rate limit applies to all environments, staging and production. Exceptions to the general rate limit are listed below.
Authenticated API requests are counted per API key, not per source IP address. Spreading requests across multiple IP addresses does not increase your effective limit.
Single Sign-On
| Name | Path | Limit |
|---|---|---|
| Get Authorization URL | /sso/authorize | 1,000 requests per 60 seconds per connection |
Directory Sync
| Name | Path | Limit |
|---|---|---|
| Directory Users | /directory_users | 4 requests per second per directory |
Organizations
| Name | Path | Limit |
|---|---|---|
| Delete Organization | /organizations/* | 50 requests per 60 seconds per API key |
Audit Logs
| Name | Path | Limit |
|---|---|---|
| Create Event | /audit_logs/events | 6,000 requests per 60 seconds per API key |
AuthKit
Rate limiting for AuthKit APIs are enforced on a per environment basis.
| Name | Path | Limit |
|---|---|---|
| Reads | /user_management/* | 1,000 requests per 10 seconds |
| Writes | /user_management/* | 500 requests per 10 seconds |
| Authentication | /user_management/authenticate | 10 requests per 60 seconds per email or challenge ID |
| Magic Auth | /user_management/magic_auth/send | 3 requests per 60 seconds per email |
| Email verification | /user_management/:id/email_verification/send | 3 requests per 60 seconds per user |
| Password reset | /user_management/password_reset/send | 3 requests per 60 seconds per email |
Hosted AuthKit
| Name | Limits |
|---|---|
| Reads | 1,000 requests per 10 seconds |
| Writes | 500 requests per 10 seconds |
| SSO sign-ins | 3 requests per 60 seconds per IP address |
| Email sign-ins | 10 requests per 60 seconds per email and IP address |
| Magic Auth sign-ins | 10 requests per 60 seconds per IP address and challenge ID |
| Magic Auth code requests | 3 requests per 60 seconds per IP address and email |
Email deliverability
Magic Auth, email verification, password reset, and invitation emails sent through WorkOS's default email provider are also subject to additional sending limits, on top of the request limits above, that protect deliverability for every customer on that shared infrastructure. These limits scale with an environment's sending history and are tuned to respond to abuse patterns such as spam and phishing.
An environment on the default WorkOS email provider that sends an unusually high volume of email, or shows sending patterns associated with spam or phishing, may have some or all of its outbound email temporarily limited, independent of the request limits listed elsewhere on this page. This applies even when using a custom email domain: a custom domain gives control over that domain's own authentication and reputation, but WorkOS still dispatches the mail through its shared default provider, so these limits still apply.
These shared-provider deliverability limits don't apply to environments that connect a custom email provider. Sending through your own provider account takes WorkOS's shared infrastructure out of the path — the most effective way to avoid these limits. It also gives full control over deliverability, and unlocks suppression management and complete delivery history. WorkOS's other sending safeguards still apply to all outbound email, regardless of provider.
WorkOS also verifies that a recipient's email domain can receive mail before sending Magic Auth codes and invitations. See testing with example domains for the recommended way to address test and placeholder users.