«Too many attempts.» and error 429 (rate_limited)

Symptom

The page shows «Too many attempts. Wait a moment and try again.», or an integration receives 429 rate_limited with a Retry-After header.

Cause

The service limits the number of requests per network, per account and per client, to stop brute force and abuse. It happens, for example:

• after many wrong passwords or codes in a row;
• when many requests come from the same network (for example a whole office behind one address trying at once);
• when an integration exceeds its budget (for example 120 request creations per minute).

Fix

• People: wait a minute and try again, calmly. Do not retry many times in a row.
• Integrations: wait the number of seconds in Retry-After before retrying, with jittered exponential backoff. The SDKs do it for you.
• One-time codes: from the fifth wrong code in a row, the method pauses (from one minute up to an hour).

When to escalate

If many people on the same network get the error at once for no clear reason, or an integration gets it while within the documented limits, contact support with the time and the source network address. Many 429s on one account may signal an attack attempt: tell security.