No rate limiting on auth or paid API routes in Supabase
highUpdated Oct 12, 2026
Supabase Auth has its own rate limits on auth endpoints. Those limits are not a promise about routes you wrote yourself.
Fix for Supabase
Supabase Auth has its own rate limits on auth endpoints. Those limits are not a promise about routes you wrote yourself. If your app proxies login or sends its own mail, limit that route. RLS does not rate-limit anything.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.