Getting HTTP 429 rate limit errors during performance testing in FusionAuth Cloud

[FASupportBot]

We are encountering a large number of HTTP 429 (Too Many Requests) errors during performance testing against our FusionAuth Cloud environment.

Error Message:

[FusionAuthCloudRateLimitedException]: Your request has been rate limited. Please reduce the number of requests or wait a period of time before making the next HTTP request.

We have run similar performance tests in the past without encountering this issue. We need to understand:

1. What are the current rate limits configured for FusionAuth Cloud environments?
2. Are these limits applied per API endpoint, tenant, application, IP address, or across the entire environment?
3. Can these rate limits be increased to support our performance testing and expected production traffic volumes?
4. What are the recommended best practices for handling higher request volumes without triggering HTTP 429 errors?

[FASupportBot]

The rate limiting you're encountering is applied at the WAF (Web Application Firewall) level on FusionAuth Cloud, not from the FusionAuth application itself. These rate limits protect customers and are standard across all FusionAuth Cloud deployments.

Rate Limit Configuration

FusionAuth does not publish rate limits publicly and they are subject to change.

Please open a support ticket to obtain more guidance.

Whitelisting for Performance Testing

Since these are network-level rate limits, they cannot be configured within your deployment. However, IP allow listing is available to bypass rate limiting for performance testing if your IP address meets these requirements:

1. It is static
2. It is owned by your company (not shared infrastructure like a CDN)
3. It is associated with a production server (not a developer's laptop)

If you can provide a static IP address that meets these criteria, you can open a support ticket to get it allow listed. Note that allow list changes typically take two to three business days to implement.

Best Practices for Performance Testing

When planning load or performance tests against FusionAuth Cloud:

• Open a support ticket before testing to notify the FusionAuth team of your planned stress test window
• Don't use Basic cloud deployments for performance testing, as they run on limited infrastructure and results won't be representative. Use a Business or High-Availability plan instead, which you can spin up, test, and tear down as needed
• Implement exponential backoff when you receive a 429 response - this is the recommended approach for handling rate limits gracefully
• Distribute requests over time rather than sending bursts of traffic

Alternative Testing Approaches

If you cannot obtain an allow-listable static IP address (such as for developer machines or CI/CD pipelines), consider:

• Running a self-hosted FusionAuth instance for automated testing, which gives you full control over rate limiting configuration
• Using smaller-scale testing that stays under the rate limits

Related Documentation

• FusionAuth Cloud - CAPTCHA and Rate Limits
• FusionAuth Cloud - Load Testing
• Troubleshooting FusionAuth Cloud API Calls
• User Search API Documentation
• Advanced Threat Detection - Customizable Rate Limiting (for application-level rate limits within FusionAuth)