Rate limits

Auth0 rate limits the Management API per tenant. Because every internal caller reaches Auth0 through uia-auth-management-api, that budget is shared. A caller that retries aggressively degrades the API for everyone else in the same tenant.

Where limits apply

What the proxy does for you

• Caches the Auth0 management token until shortly before expiry, so a token is not minted per request
• Shares one in-flight token request when several calls arrive on a cold cache
• Passes Auth0’s 429 through with its Retry-After header rather than hiding it

What it does not do

• It does not queue or smooth your traffic
• It does not retry on your behalf
• It does not give one caller a private share of the tenant budget

How to behave as a caller

Honor Retry-After

On a 429, wait the interval the response gives before retrying.

Back off exponentially, with jitter

Retry after a growing delay, randomized so simultaneous callers do not synchronize. Cap the delay and the number of attempts.

Request a page, not a record at a time

One list call with per_page=50 costs one request. Fifty lookups by id cost fifty.

Cache what rarely changes

Connections, roles, and client configuration change infrequently. Read them once and cache them.

Move bulk work off the request path

Large imports and backfills belong in a background job that can be paced, not in a user-facing request.

Spread scheduled jobs

Jobs that all start on the hour will collide. Stagger them.

Signs you are near the limit

• 429 responses appearing in normal operation
• Latency rising across every endpoint at once
• Retries outnumbering first attempts

Requesting more headroom