Supabase Auth over_request_rate_limit (429 Too Many Requests)

What it means in plain English

Supabase's Auth error-code table defines over_request_rate_limit as: too many requests have been sent by this client (IP address). It says to ask the user to try again in a few minutes. It adds that this can sometimes indicate a bug in your application that mistakenly sends out too many requests, such as a badly written useEffect React hook.

Supabase's Auth rate-limits page says that when rate limits are exceeded, a 429 Too Many Requests error is returned. Auth uses a token bucket for endpoints limited by IP address. Most buckets hold up to 30 requests. Once a bucket empties, requests are rate limited until tokens refill.

over_email_send_rate_limit is a different code: too many emails were sent to one address. See Supabase email rate limit exceeded.

Likely causes

• One client sent more Auth requests than its IP limit allows.
• A useEffect or retry loop calls Auth over and over. Supabase names a badly written useEffect as an example.
• Auth calls come from your server or a proxy, so Supabase counts every user against the server's IP address. The rate-limits page describes this case for server-side frameworks and proxies.

These are the IP-limited defaults on the rate-limits page:

• Sign-ups and sign-ins (/auth/v1/signup, /auth/v1/recover, /auth/v1/resend, /auth/v1/magiclink, /auth/v1/otp, /auth/v1/user): 30 requests per 5 minutes, with bursts up to 30. Anonymous sign-ins are excluded.
• Verification requests (/auth/v1/verify): 30 requests per 5 minutes, with bursts up to 30.
• Token endpoint requests (/auth/v1/token): 150 requests per 5 minutes, with bursts up to 30. This covers password, refresh token, ID token, and PKCE grants.

How to fix it, step by step

1. Read error.code. Stay on this page when it is over_request_rate_limit. Supabase says to identify errors by error.code and error.name, not by matching the message.
2. Stop the retries, and have the user try again in a few minutes, as the error-code table says.
3. Look for code that calls Auth on every render, such as a useEffect with missing or changing dependencies, or a retry loop with no limit.
4. If Auth calls run on your server or behind a proxy, Supabase can rate limit by the end user's IP address instead. Set the Sb-Forwarded-For header to the end-user IP address and send the request with a secret API key. Supabase says publishable keys and legacy anon or service_role keys are not supported for this. New projects must turn it on under the IP Address Forwarding section at Authentication > Rate Limits.
5. Some limits are customizable. You can change them in your project at Authentication > Rate Limits.

How to check it worked

• The same Auth call no longer returns 429 or over_request_rate_limit.
• Your logs show one Auth request per user action, not a burst.

Sources

• https://supabase.com/docs/guides/auth/debugging/error-codes (opens in a new tab)
• https://supabase.com/docs/guides/auth/rate-limits (opens in a new tab)