# Diagnose: rate limits
## Symptom
Intermittent `429 Too Many Requests` from Auth0 endpoints, sometimes cascading into user-visible failures.
## Likely causes
1. /oauth/token hammered by M2M code minting per request.
2. /dbconnections/signup or passwordless endpoints hit by a retry loop or a bot.
3. Management API paginated listing without backoff.
4. Load test or bulk import against the wrong tenant.
## Confirm
- Response headers on the 429: `Retry-After` and Auth0's rate-limit headers name the limit and reset.
- Monitoring > Logs: filter for rate-limit event types. The events name the endpoint and the client. One client dominating = fix the client, not the tenant.
- Correlate timestamps with deploys or cron jobs; a new 429 that starts at 02:00 is a batch job.
## Fix
- Token caching with single-flight for /oauth/token.
- Exponential backoff with jitter on 429; honor Retry-After.
- Self-throttle UI resends (passwordless, reset) with countdowns.
- Management API: page slowly, cache, and use the `include_totals=false` where supported.
## Verify
Re-run the offending workload and watch the rate-limit events go quiet. Add client-side metrics on token-request counts so the next regression pages before users notice.