Skip to main content
Rate limits control how often Authsignal sends an OTP code or magic link, and how many codes a user can submit. They help mitigate abuse such as SMS pumping, inbox flooding, and code guessing.

​
How rate limits work

Each limit uses a sliding window. Authsignal counts the sends in the period leading up to each new request, not in fixed blocks of time. There are five types of limit: When you set more than one limit, Authsignal enforces all of them, so a request is blocked as soon as any one is exceeded.

​
Rate limit details

​
Per recipient

A per recipient limit caps how many codes or links Authsignal sends to one phone number or email address in a window. Default: 6 every 10 minutes for SMS OTP and WhatsApp OTP. 12 every 10 minutes for Email OTP and email magic link. Portal setting: open Authenticators, select the authenticator, and edit Rate limits under Sending in Rate limit settings. For SMS OTP, the setting is under Per number. Management API: set sendingRateLimitConfigurations on an SMS OTP or Email OTP authenticator. For example, see Update SMS OTP authenticator configuration. Use case: limit how many messages a script or an impatient user can trigger to one inbox or phone, and help control your SMS costs for any single number.
To help limit slow, steady abuse as well as bursts, click Add rate limit to add a second, longer limit. For example, 6 every 10 minutes and 20 every 24 hours.

​
Cooldown

A cooldown is a resend rate limit. It sets the minimum wait between codes or links sent to one phone number or email address, such as 10 seconds. It is not the code expiry, which sets how long a code stays valid, and it is not how long a flow session stays open. Default: 5 seconds for SMS OTP and WhatsApp OTP. 10 seconds for Email OTP and email magic link. Portal setting: in Rate limit settings, under Sending, turn on Cooldown and enter how many seconds to wait, up to 60. Management API: add a limit with a rateLimit of 1 to sendingRateLimitConfigurations, and set windowInMinutes to the wait in minutes, such as 0.5 for 30 seconds.
SMS OTP rate limit settings with Cooldown turned on to wait 5 seconds before another OTP code can be sent, and a rate limit of 6 OTP codes every 10 minutes

An SMS OTP cooldown of 5 seconds, above a rate limit of 6 codes every 10 minutes

Use case: reduce duplicate messages from double taps and repeated Re-send code clicks while the first message is still on its way. In the pre-built UI, the re-send link stays disabled until the cooldown ends.

​
Country

A country limit caps how many SMS codes Authsignal sends to any number in a country. Default: none. When you add one, the portal suggests 100 every 60 minutes. Portal setting: open the SMS OTP authenticator. In Rate limit settings, click Show advanced settings, then click Add country limit under Per country. Set Numbers covered to any number, then choose the countries. Management API: add an entry to prefixRateLimitConfigurations on the SMS OTP authenticator. Set blockSize to country, enabled to true, and countryCodes to the countries it covers. Use case: limit SMS pumping, where attackers trigger codes to high-cost numbers they profit from. Set a tight limit for countries you don’t serve, and a looser one for your main markets. A limit for a specific country replaces an All countries limit for numbers in that country.

​
Number block

A number block limit caps how many SMS codes Authsignal sends to a group of consecutive phone numbers. A group of 10,000 numbers covers every number that matches except for the last 4 digits. For example, +44 7700 900000 to +44 7700 909999. Default: none. Portal setting: add a country limit as above, then set Numbers covered to groups of 1,000, 10,000, or 100,000 numbers. Management API: add an entry to prefixRateLimitConfigurations with blockSize set to the group size, such as 10000, and enabled set to true. Use case: limit SMS pumping that cycles through a range of numbers. Each number can stay under its per recipient limit while the block as a whole reaches its limit. This limits sends to the affected range without limiting the rest of the country.

​
Submission

A submission limit caps how many codes a user can submit in a window. It helps protect against attackers guessing codes. Default: 10 every 5 minutes for SMS OTP, WhatsApp OTP, Email OTP, and authenticator app. Portal setting: in Rate limit settings, edit Submission. Management API: set submissionRateLimitConfiguration on an SMS OTP or Email OTP authenticator. Use case: a 6-digit code has a million possible values. A submission limit reduces the chance that an attacker guesses one before it expires.

​
Default limits

​
Sandbox codes

Rate limits also apply in sandbox mode. Sends count toward the sending limits, and each sandbox code you submit counts toward the submission limit. If your automated tests submit many codes for one test user, spread them across several test users or raise the submission limit on your test tenant.

​
Try it: add a cooldown

  1. In the Authsignal Portal, open Authenticators and select Email OTP.
  2. In Rate limit settings, under Sending, turn on Cooldown if it’s off.
  3. Set the wait to 30 seconds, then click Save changes.
  4. Start an action that shows the pre-built UI, and choose Email OTP.
  5. After the code arrives, the Re-send code link stays disabled for 30 seconds.