> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.generaltranslation.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Rate limit policies for the Free Public subscription type.

# Free

See below for the rate limit policies for the Free subscription type.

<AccordionGroup>
  <Accordion title="Authentication API: Rate limits for the Authentication API and API endpoints in the Free subscription type.">
    <table class="table">
      <thead>
        <tr>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#api-rate-limits">API</a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Burst Request Limit</a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Sustained Request Limit</a></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>Authentication API</td>
          <td>300</td>
          <td>300/minute</td>
        </tr>
      </tbody>
    </table>

    <table class="table">
      <thead>
        <tr>
          <th>Endpoint</th>
          <th>Method</th>
          <th>Path</th>
          <th>Burst Request Limit</th>
          <th>Sustained Request Limit</th>
          <th>Limit Type</th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>User Info</td>
          <td>GET, POST</td>
          <td><code>/userinfo</code></td>
          <td>10</td>
          <td>5 per/min</td>
          <td>To a unique user ID</td>
        </tr>

        <tr>
          <td>Change Password</td>
          <td>POST</td>
          <td><code>/dbconnections/change\_password</code> & <code>u/reset-password/request/:connection</code></td>
          <td>10</td>
          <td>1 per/min</td>
          <td>From an IP address to a unique email address</td>
        </tr>

        <tr>
          <td>Get Passwordless Code or Link</td>
          <td>GET, POST</td>
          <td><code>/passwordless/start</code></td>
          <td>50</td>
          <td>50 per/hr</td>
          <td>From an IP address</td>
        </tr>

        <tr>
          <td>Get Token</td>
          <td>POST</td>
          <td><code>/oauth/token</code></td>
          <td>30</td>
          <td>30 per/sec</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Cross Origin Authentication</td>
          <td>POST</td>
          <td><code>co/authenticate</code></td>
          <td>5</td>
          <td>5 per/sec</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Authentication</td>
          <td>POST</td>
          <td><code>/usernamepassword/login</code></td>
          <td>5</td>
          <td>5 per/sec</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>JSON Web Token Keys</td>
          <td>GET</td>
          <td><code>/.well-known/jwks.json</code></td>
          <td>20</td>
          <td>20 per/sec</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Native Social Login</td>
          <td>POST</td>
          <td><code>/oauth/token</code></td>
          <td>50</td>
          <td>50 per/min</td>
          <td>Any Request for Apple or Facebook Native Social Login</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/authentication#dynamic-application-client-registration">Dynamic Application (Client) Registration</a></td>
          <td>POST</td>
          <td><code>/oidc/register</code></td>
          <td>5</td>
          <td>5 per/sec</td>
          <td>Any request</td>
        </tr>
      </tbody>
    </table>

    \*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read [Suspicious IP Throttling](/docs/secure/attack-protection/suspicious-ip-throttling).
  </Accordion>

  <Accordion title="Management API: Rate limits for the Management API on the Free subscription tier.">
    <table class="table">
      <thead>
        <tr>
          <th><strong>API</strong></th>
          <th><strong>Burst Request Limit</strong></th>
          <th><strong>Sustained Request Limit</strong></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>Management</td>
          <td>2</td>
          <td>2/second</td>
        </tr>
      </tbody>
    </table>

    <table class="table">
      <thead>
        <tr>
          <th><strong>Endpoint</strong></th>
          <th><strong>Method</strong></th>
          <th><strong>Path</strong></th>
          <th><strong>Burst Request Limit</strong></th>
          <th><strong>Sustained Request Limit</strong></th>
          <th><strong>Limit Type</strong></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>Register Dynamic Client</td>
          <td>POST</td>
          <td><code>/oidc/register</code></td>
          <td>5</td>
          <td>5/second</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Verify Custom Domain</td>
          <td>POST</td>
          <td><code>/api/v2/custom-domains{id}/verify</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Read Status Connection</td>
          <td>POST</td>
          <td><code>/api/v2/connections/{id}/status</code></td>
          <td>100</td>
          <td>15/second</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Rotate Signing Keys</td>
          <td>POST</td>
          <td><code>/api/v2/keys/signing/rotate</code></td>
          <td>5</td>
          <td>5/day</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Configure email templates</td>
          <td>POST, PATCH, DELETE</td>
          <td><code>/api/v2/email-templates</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Read email templates</td>
          <td>GET</td>
          <td><code>/api/v2/email-templates</code></td>
          <td>10</td>
          <td>50/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Configure email provider</td>
          <td>POST, PATCH, DELETE</td>
          <td><code>/api/v2/emails/provider</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Read email provider</td>
          <td>GET</td>
          <td><code>/api/v2/emails/provider</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>
      </tbody>
    </table>
  </Accordion>
</AccordionGroup>