Skip to main content

Rate limits

Clerk rate limits certain endpoints to help protect users against brute-force attacks or to stop abuse of Clerk's platform.

Errors

If you receive a 429 error code, you have been rate limited. All subsequent requests to that specific endpoint will be blocked for a given amount of time.

Requests that have been rate limited will receive the Retry-After response header, which contains the number of seconds after which the block expires.

Frontend API requests

Frontend API requests are rate-limited per user and identified by their IP address.

  • Name
    Create SignIn
    Type
    /v1/sign_ins
    Description

    5 requests per 10 seconds

  • Name
    Create SignUp
    Type
    /v1/sign_ups
    Description

    5 requests per 10 seconds

  • Name
    Attempt SignIn
    Type
    /v1/sign_ins/attempt_(first|second)_factor
    Description

    3 requests per 10 seconds

  • Name
    Attempt SignUp
    Type
    /v1/sign_ups/attempt_verification
    Description

    3 requests per 10 seconds

Backend API requests

Backend API requests are rate-limited per application instance which is identified by the that is provided when making Backend API requests.

General limit

All Backend API endpoints and methods, including GET requests, are subject to a general limit that differs based on whether you're using a development or production instance:

  • Name
    Production instances
    Description

    1000 requests per 10 seconds

  • Name
    Development instances
    Description

    100 requests per 10 seconds

Endpoint-specific limits

The following endpoints have their own rate limits. Any endpoint not listed below uses the general limit above.

  • Name
    Get the JWKS of the instance
    Type
    GET /v1/jwks
    Description

    No rate limit

  • Name
    Create a new invitation for the given email address and sends the invitation email
    Type
    POST /v1/invitations
    Description

    100 requests per hour

  • Name
    Create multiple invitations for the provided email addresses
    Type
    POST /v1/invitations/bulk
    Description

    25 requests per hour

  • Name
    Create a new Organization invitation and send an email to the provided email address
    Type
    POST /v1/organizations/{organization_id}/invitations
    Description

    250 requests per hour

  • Name
    Create new Organization invitations in bulk and send out emails to the provided email addresses
    Type
    POST /v1/organizations/{organization_id}/invitations/bulk
    Description

    50 requests per hour

  • Name
    Update a user's data or metadata
    Type
    PATCH /v1/users/{user_id}, PATCH /v1/users/{user_id}/metadata, and PUT /v1/users/{user_id}/metadata
    Description

    10 requests per 10 seconds per user

  • Name
    Update an Organization's data or metadata
    Type
    PATCH /v1/organizations/{organization_id}, PATCH /v1/organizations/{organization_id}/metadata, and PUT /v1/organizations/{organization_id}/metadata
    Description

    10 requests per 10 seconds per Organization

  • Name
    Update an Organization membership's data or metadata
    Type
    PATCH /v1/organizations/{organization_id}/memberships/{user_id} and PATCH /v1/organizations/{organization_id}/memberships/{user_id}/metadata
    Description

    10 requests per 10 seconds per Organization membership

Note

The currentUser() helper uses the GET /v1/users/me endpoint, so it is subject to the respective rate limits.

Feedback

What did you think of this content?

Last updated on

GitHubEdit on GitHub