Ory · Rate Limits

Ory Rate Limits

Ory Network enforces per-project rate limits scaled by subscription plan and environment type (production vs dev/staging). Each policy combines a burst limit (requests per second) and a sustained limit (requests per minute). Limits documented here apply specifically to the /sessions/whoami endpoint as published; many other endpoints have their own service-specific quotas. Endpoints return HTTP 429 when limits are exceeded.

Ory Rate Limits is the machine-readable rate-limit profile for Ory on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 8 rate-limit definitions, measuring requests_per_second and varies.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled and quotaExceeded.

Tagged areas include Rate Limiting, Identity, OAuth2, OpenID Connect, and CIAM.

8 Limits Throttle: 429 Quota: 429
Rate LimitingIdentityOAuth2OpenID ConnectCIAM

Limits

Developer plan (all environments) - /sessions/whoami project/environment
requests_per_second · second
10
Sustained limit 300 rpm. Applies to Developer (free) plan in all environments.
Production plan - production environment - /sessions/whoami project/environment
requests_per_second · second
80
Sustained 1800 rpm in production environment.
Production plan - dev/staging - /sessions/whoami project/environment
requests_per_second · second
10
Sustained 300 rpm. Dev/staging environments retain Developer-tier limits.
Growth plan - production environment - /sessions/whoami project/environment
requests_per_second · second
800
Sustained 18000 rpm in production environment.
Growth plan - dev/staging - /sessions/whoami project/environment
requests_per_second · second
10
Sustained 300 rpm.
Enterprise plan - production environment - /sessions/whoami project/environment
requests_per_second · second
1200
Sustained 36000 rpm in production environment.
Enterprise plan - dev/staging - /sessions/whoami project/environment
requests_per_second · second
10
Sustained 300 rpm.
Other endpoints project/environment
varies
see service-specific rate limits in the Ory rate-limits guide
Identity, session, OAuth2, and permission endpoints have their own per-endpoint burst/sustained policies tied to the same plan tiers.

Policies

Burst vs Sustained
Each policy defines a burst (requests per second) and sustained (requests per minute) limit. Both must be respected.
Inflight Protection
Write operations on identity and session endpoints have additional inflight protection that returns HTTP 429 when concurrency exceeds the policy limit.
Backoff
Clients receiving 429 responses should pause and retry with exponential backoff and jitter; specific Retry-After semantics are not documented.
Plan Scoping
Limits scale by both plan tier and environment type. Dev and staging environments retain Developer-tier ceilings even on paid plans.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/ory-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.