AUTH STARTER · RATE LIMITING

Rate limiting

Built into Better Auth, auto-enabled in production only. Defaults to 100 req/min — tune in authConfig.

Rate limiting is enabled in production and disabled in development so you can hammer the API while building. Limits are per-IP, sliding window.

Configure

TypeScript

// src/auth.config.ts
rateLimit: {
  enabled: process.env.NODE_ENV === "production",
  window: 60,  // seconds
  max: 100,    // requests per window
},

100/min is generous on purpose

We chose loose defaults so legitimate retries don't get blocked. If you're getting hammered by credential stuffing, drop max to 10-20 — sign-in flows shouldn't need more.

Rate limiting alone isn't a brute-force defense

Per-IP limits don't stop distributed attacks across thousands of IPs. Pair with captcha, password complexity checks, and account lockouts after N failures. Treat rate limiting as one layer, not THE layer.

Behind a reverse proxy?

If your app is behind Cloudflare, Vercel's edge, or any reverse proxy, the IP Better Auth sees is the proxy — not the user. Configure trustedOrigins and make sure X-Forwarded-For is honored, or per-IP rate limits become "per-proxy" rate limits.

PreviousCaptcha (Turnstile)NextAdmin & roles