| Boundary | Current limit |
|---|---|
| Enrollment start / resend | 5 requests per 10-minute window; resend cooldown is 60 seconds. |
| Password sign-in | 8 requests per 10-minute window; five failed password attempts trigger a 15-minute credential lockout. |
| Passkey sign-in | 12 requests per 10-minute window. |
| Email OTP sign-in | 5 requests per 10-minute window per account and 20 per source IP. |
| Recovery start / resend | 5 requests per 10-minute window; recovery codes expire after 10 minutes and resend cooldown is 60 seconds. |
| Webhook delivery | Five-second timeout, eight-attempt maximum, capped backoff. |
| Other APIs | Endpoint-specific; honor the response's RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, and Retry-After values. |
RESOURCES
Rate limits
Documented limits are endpoint-specific; Lucion does not promise a universal public quota on this page.