Too many attempts: passwordless and signup throttles

TL;DR: Auth0 throttles signup, passwordless sends, and password resets per identifier. Users who hammer resend get locked out longer; the app should rate-limit itself first. Disable the resend button with a countdown (60s) after each send. Never - Do not auto-retry these endpoints in code. - Do not build a "resend every 10 seconds" loop for tests; use the Management API to verify users in test tenants instead.

The fix

TL;DR: Auth0 throttles signup, passwordless sends, and password resets per identifier. Users who hammer resend get locked out longer; the app should rate-limit itself first. Disable the resend button with a countdown (60s) after each send. Never - Do not auto-retry these endpoints in code. - Do not build a "resend every 10 seconds" loop for tests; use the Management API to verify users in test tenants instead.

The fix

1. "You have exceeded the maximum number of passwordless tries" / SMS/email throttled.
2. Signup blocked after repeated attempts.
3. "Too many requests" on /dbconnections/change_password.
4. Disable the resend button with a countdown (60s) after each send. This single UI change eliminates most throttle hits.
5. Show the throttle message honestly: "We have sent you several codes; wait a few minutes and try the latest one." Do not show a generic error.
6. Cap resends per session (e.g. 5) then require starting over.
7. For password reset, same pattern: one active ticket at a time; resending invalidates the previous link, so tell the user to use the newest email.
8. Do not auto-retry these endpoints in code.
9. Do not build a "resend every 10 seconds" loop for tests; use the Management API to verify users in test tenants instead.
10. Resend UI is self-throttling with visible countdowns.
11. Users are told to use the newest code/link.

When to use this

• This covers exactly what the title says: Too many attempts.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Too; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Too behavior.

Auth0's rate limit policy documents the throttles on the passwordless, signup, and change-password endpoints. Verified against live docs 2026-09-26.