Spring Security · Rate Limits

Spring Security Rate Limits

Spring Security is a self-hosted authentication and authorization framework — there is no vendor-hosted API and therefore no vendor-imposed throughput limits. Spring Authorization Server (a Spring Security sub-project) ships token endpoints whose throughput is bounded only by the operator's deployment. Throttling is added by the surrounding gateway, Resilience4j, or a custom filter.

Spring Security Rate Limits is the machine-readable rate-limit profile for Spring Security on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 1 rate-limit definition, measuring varies.

The profile also includes 2 backoff/retry policies defined and response codes documented for throttled.

Tagged areas include Authentication, Authorization, Java, OAuth2, and Spring Framework.

1 Limits Throttle: 429
AuthenticationAuthorizationJavaOAuth2Spring FrameworkRate Limiting

Limits

Operator-Defined deployment
varies
see operator deployment configuration
Spring Security and Spring Authorization Server emit no built-in throttling. Effective limits depend on the gateway, ingress, or filter chain in front of the OAuth2 endpoints.

Policies

Self-Hosted Throttling
Operators commonly add a Servlet or WebFlux filter (often Resilience4j-backed) that emits 429 with Retry-After when the token endpoint is hammered. Spring Security itself does not enforce a request rate.
Lockout vs Throttle
Spring Security distinguishes account-lockout policy (UserDetailsService / failed-login counter) from request-rate throttling. Lockout is per-principal; throttling is per-IP or per-key and lives in the surrounding stack.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/spring-security-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.