Description

Ensure the Auth rate limits for sending emails and SMS, one-time passwords (OTP), sign-ups, token refreshes, token verifications, and anonymous sign-ins are reviewed and set to values that match the application's expected traffic, rather than being raised too high.

Rationale

Auth endpoints are common targets for abuse, such as sending large numbers of OTP codes or emails, brute-forcing codes, or creating many accounts. Rate limits slow down these attacks and protect users from being flooded with messages. Limits that are set too high remove this protection, so they should be reviewed and kept as low as the application allows.

Impact

  • Slows down brute-force and spam attacks

  • Protects users from floods of auth emails and SMS

  • Limits set too low can block real users during traffic spikes

Default Value

By default, Supabase applies built-in rate limits, such as 360 OTP requests per hour and 1800 token refresh requests per hour per IP. The email limit can only be raised with custom SMTP.

Pre-Requisites

  • Project Owner or Admin role

  • An estimate of normal sign-up and sign-in traffic

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar and select Rate Limits.

  4. Review each rate limit and compare it with your expected traffic.

  5. If any limit is higher than needed, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar and select Rate Limits.

  4. Lower each limit to a value that fits your expected traffic.

  5. Select Save.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Authentication in the sidebar and select Rate Limits.

  4. Set each limit back to its previous value.

  5. Select Save.

Reference