Okta 429 Errors Occur When Application Rate Limit Caps Are Reached

Okta returns a 429 error when an individual application exceeds its configured percentage of an API endpoint rate limit because application-level rate limits do not benefit from organization-level burst capacity. Adjusting the application capacity percentage or optimizing the application API calls resolves the issue. When the application exceeds the limit, Okta generates the following error:

429 Too Many Requests

• Okta Identity Engine (OIE)
• Okta Classic Engine
• API Rate Limits
• Application Rate Limiting

The application exceeds its allocated percentage of the endpoint rate limit. While Okta provides burst capacity at the organization level, this burst capacity does not apply to application-level rate limit caps.

When do burst rate limits apply?

Okta applies burst rate limits to organization-level API traffic. When administrators do not configure application-specific capacity percentages, all applications share the organization-level limit and benefit from the burst multiplier. Okta does not apply burst rate limits to individual application caps. When administrators assign a specific capacity percentage to an application, Okta enforces a strict limit based on the base endpoint capacity, and the application cannot access the organization-level burst capacity.

How do application rate limits interact with burst capacity?

Okta provides organization-level burst capacity to handle temporary spikes in API traffic. However, when administrators configure application-level rate limiting, Okta enforces a strict cap based on the allocated percentage of the base endpoint limit. Okta does not apply burst capacity to these individual application caps. When an application reaches its limit, Okta returns a 429 error, even if the organization has remaining burst capacity.

How does Okta calculate application rate limits in a worked example?

Review the following example parameters to understand the interaction between base limits, burst multipliers, and application capacities.

• Base Endpoint Limit: 1800 requests per minute
• Organization Burst Multiplier: 5x (allowing up to 9000 requests per minute at the organization level)
• Application A Capacity: 50 percent
• Application B Capacity: 50 percent

In this scenario, Okta caps Application A at 900 requests per minute (50 percent of 1800). Okta caps Application B at 900 requests per minute. If Application A sends 1000 requests in one minute, Okta generates a 429 error for Application A. Application A cannot use the 5x organization burst capacity to exceed its 900-request limit.

What steps resolve the rate limit error?

Navigate to the Rate Limits settings in the Admin Console and increase the capacity percentage for the affected application.

1. Open the Admin Console.
2. Navigate to Settings, and then select Rate Limits.
3. Choose the Application tab.
4. Select Edit next to the target application.
5. Enter a higher percentage in the Capacity field.
6. Select Save.

NOTE: Ensure that the total capacity across all applications does not exceed 100 percent.