Ory · Rate Limits

Ory Corp Rate Limits

Ory Network applies per-project rate limits that differ by endpoint class and plan tier. Public / frontend endpoints (self-service flows, OAuth2 token and authorization, session whoami, permission checks) and privileged admin endpoints (identity admin, OAuth2 admin, relationship writes, Console) are metered in separate buckets, and admin surfaces are generally allowed higher throughput than anonymous public surfaces. Limits scale up on paid Production, Growth, and Enterprise plans. When self-hosting the open-source Ory stack, there is no Ory-imposed rate limit - throughput is bounded only by your own infrastructure and any proxy/gateway you place in front (for example Ory Oathkeeper or an ingress). Requests over the limit receive HTTP 429 with a Retry-After header.

Ory Corp Rate Limits is the machine-readable rate-limit profile for Ory on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 4 rate-limit definitions, measuring requests.

The profile also includes 3 backoff/retry policies defined and response codes documented for throttled.

Tagged areas include Identity, Authentication, OAuth2, Authorization, and Rate Limiting.

4 Limits Throttle: 429
IdentityAuthenticationOAuth2AuthorizationRate LimitingQuotas

Limits

Public / Frontend Endpoints project
requests
per plan (tiered)
Self-service flows, OAuth2 auth/token, sessions/whoami, and permission checks; anonymous or session-scoped.
Admin Endpoints project
requests
per plan (tiered, higher than public)
Identity admin, OAuth2 admin, relationship writes, courier, and organization management using an Ory API key.
Console API workspace
requests
per plan (tiered)
Project, token, event stream, and subscription management on api.console.ory.sh.
Self-Hosted Throughput deployment
requests
hardware-bound (no Ory-imposed limit)
Open-source Kratos/Hydra/Keto/Oathkeeper; constrained by your own infrastructure.

Policies

Tiered Limits
Rate limits increase from Developer to Production to Growth to Enterprise; Enterprise agreements can raise them further.
Endpoint-Class Buckets
Public/frontend and privileged/admin endpoints are throttled independently so admin automation does not starve end-user flows.
Backoff Strategy
Clients should implement exponential backoff with jitter and honor the Retry-After header on 429 responses.

Sources