# Too many attempts
## The errors
- "You have exceeded the maximum number of passwordless tries" / SMS/email throttled.
- Signup blocked after repeated attempts.
- "Too many requests" on /dbconnections/change_password.
## Why
These endpoints are abuse targets, so Auth0 throttles per email/phone/IP with documented limits in the rate limit policy. The throttle is per identifier, so one user hammering resend does not affect others, but that user is stuck until the window passes.
## App-side fixes
1. Disable the resend button with a countdown (60s) after each send. This single UI change eliminates most throttle hits.
2. Show the throttle message honestly: "We have sent you several codes; wait a few minutes and try the latest one." Do not show a generic error.
3. Cap resends per session (e.g. 5) then require starting over.
4. For password reset, same pattern: one active ticket at a time; resending invalidates the previous link, so tell the user to use the newest email.
## Never
- Do not auto-retry these endpoints in code.
- Do not build a "resend every 10 seconds" loop for tests; use the Management API to verify users in test tenants instead.
## Checklist
- Resend UI is self-throttling with visible countdowns.
- Users are told to use the newest code/link.