Rate Limiting

Own Auth applies built-in rate limits to sensitive authentication entry points. Core limits do not need middleware or separate configuration.

For the account and network limits around the built-in counters, read Rate limiting authentication endpoints.

These limits reduce password guessing, credential stuffing, repeated email and SMS sends, excessive invitations, and excessive key creation.

SMS codes allow five wrong guesses by default. MFA challenges also allow five failed attempts by default. These per-credential attempt limits are enforced separately from the shared rate-limit store through sms.maxAttempts and mfa.maxAttempts.

Own Auth throws AuthError with:

• code: rate_limited
• statusCode: 429
• safeMessage: Too many attempts. Try again later.

import { isAuthError } from "own-auth";

try {
  await auth.signInEmailPassword({ email, password });
} catch (error) {
  if (isAuthError(error) && error.code === "rate_limited") {
    return res.status(error.statusCode).json({
      error: error.safeMessage,
    });
  }

  throw error;
}

AuthError does not currently include a retryAfterMs value. Do not read or document that field unless the public error contract adds it.

With the default Postgres setup, Own Auth stores counters in own_auth_rate_limits in the same database as the auth data. The Cloudflare D1 adapter uses the same table in D1.

The counters survive server restarts and are shared by every application instance connected to that database. No additional rate-limit configuration is needed for the default setup.

const auth = createOwnAuth({
  tokenPepper: process.env.OWN_AUTH_TOKEN_PEPPER,
});

Most built-in core operation limits and windows are not configurable. Protected-resource operators can size remote introspection for their traffic with authorizationServer.resourceIntrospectionRequestsPerMinute and authorizationServer.failedIntrospectionAttemptsPerMinute. SCIM operators can configure scim.requestLimit, scim.requestWindowMs, scim.failedAuthLimit, and scim.failedAuthWindowMs. Authenticated SCIM traffic shares one limit per connection. Failed SCIM authentication is limited only when the handler receives a trusted IP address through getRequestContext.

Plugins may declare their own namespaced endpoint rate limits, but cannot replace or weaken core limits.

Set up Audit logs to track auth events, or review the full Security model.