Rate Limiting for Management APIs

Get Help
,
1

Hi, i am looking at migrating 75k users from my legacy system to Auth0. I’ll be interacting with Create/Update User along with Password Change Ticket APIs. I was wondering if i would hit any sort of rate limits. All the calls will be from a server.

Thank you in advance.

Regards.

3

Hi @Davidson.Mohanty, and welcome to the Auth0 Community!

A script that attempts to migrate 75,000 users as fast as possible without any delays will almost certainly hit the rate limit, receive an HTTP 429 Too Many Requests error, and be temporarily blocked from making further requests.

Please take a look at our Rate Limit Policy and most importantly at the information found here to solve your use case.

In short, you will have to:

  1. Check the Rate Limit Headers: After every API call, inspect the HTTP headers in the response.
  • X-RateLimit-Limit: The total number of requests you can make in the current time window.
  • X-RateLimit-Remaining: The number of requests you have left.
  • X-RateLimit-Reset: A UTC epoch timestamp indicating when the limit will reset.
  1. Handle 429 Errors: When you receive an HTTP 429 status code, your script should pause. Use the X-RateLimit-Reset header to determine how long to wait before making the next request.

You could add a sleep in your migration logic as a simple mechanism but a more robust approach is to implement an exponential backoff strategy. This means if you get a 429 error, you wait for a short period (e.g., 1 second), then retry. If it fails again, you wait longer (e.g., 2 seconds), then 4 seconds, and so on. This prevents overwhelming the API as soon as the limit resets.

I hope this information answers your question!
Teodor.