What Is the Rate Limit for Password Validation in Okta
Last Updated:
Administration
Okta Identity Engine
Overview
Okta limits password validation to 4 requests per second per username on API endpoints that accept username and password credentials, including the Authentication API and the OAuth 2.0 resource owner password flow, to prevent brute-force attacks.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Rate Limit
Solution
What is the rate limit for password validation?
The rate limit for password validation is four requests per second.
Review the actions, Okta API endpoints, and per-user limits for all organizations in the provided table.
|
Action and Okta API endpoint |
Per User limits (all orgs) |
|---|---|
|
Authenticate the same user: |
4 per second |
|
Generate or refresh an OAuth 2.0 token: /oauth2/v1/token |
4 per second |
Related References
