Hi,
we are currently preparing a Go Live of a customer portal.
We have like 10 users that are currently testing the production environment and ran already into rate limits. I checked the logs but did not find anything that relates to rate limits.
I used filters like type:api_limit or type:limit_delegation but there were no logs.
Can you help me examining the issues.
Ready to post? 
First try searching for your answer.
Hi @Alois.Goeth
Thank you for reaching out to us!
I understand that your application is hitting a rate limit with 10 users running tests, however your logs do not show any related records.
Overview
When you are filtering against api_limit, this log type is triggered when a global rate limit is exceeded, however it is not triggered for user-level, IP-level, or endpoint-specific rate limits. In addition, Auth0 throttles global rate limit logs: if they were hitting a global limit, Auth0 only generates one api_limit log per minute for each 429 request to prevent flooding the tenant logs.
When encountering the rate limit error scree shared in the screenshot, can you please click on the " See details for this error " link? This should provide additional technical details regarding the error itself which can help pin-point the exact cause.
Potential causes
To provide additional details, here are some possible causes for seeing this rate limiting, based on the information we currently have:
1. Universal Login (UL) Prompt Limits
The New Universal Login experience has strict, non-customizable limits applied per transaction and per IP to ensure platform stability:
Page loads: Up to 10 per minute.
Login submissions: Up to 5 per minute.
If the testers are aggressively reloading the login prompt or repeatedly submitting credentials, the UI will throw an invalid_request: You've exceeded the rate limit for /u/login/identifier error. This does not generate an api_limit log.
2. IP-Level or User/Device-Level Limits
If the users are testing from a single corporate NAT/VPN, they might be hitting IP rate limits (like the “same user login” rate limit of 20 attempts per minute from one IP).
How to find this: Instead of searching by type:api_limit, search the tenant logs for the following text descriptions:
"You passed the limit of allowed calls to [PATH] from ip: [IP]""You have exceeded the rate limit on [PATH]"3. Brute Force or Bot Detection
If the testers are intentionally failing logins (e.g., testing incorrect passwords or expired magic links), they may be triggering Brute-Force Protection or Bot Detection.
How to find this:
Check for the log type gd_otp_rate_limit_exceed (Too Many Failures).
Enable the Risk Assessment option in the Bot Detection feature to generate Pre-login risk assessment logs (log type: pla). An extensive number of these from a single IP leads to rate-limited requests.
Looking forward to your input on the above!
Best regards,
Gerald