The following auth operations have limitations on the frequency you can perform them. Contact Firebase a few weeks in advance to discuss special use cases.
Daily Instrumentless Usage Limits
The following limits are daily usage limits for users of Firebase Authentication with Identity Platform on the no-cost Spark plan. These usage limits correspond directly to Google Cloud Pricing Tiers.
| Usage | Instrumentless Limit |
|---|---|
| Tier 1 Daily Active Users | 3000 per day |
| Tier 2 Daily Active Users | 2 per day |
| SMS Sent | 10 per day |
| Multi Factor Authentications | 10 per day |
Account creation and deletion limits
| Operation | Limit |
|---|---|
| New account creation | 100 accounts/IP address/hour |
| Account deletion | 10 accounts/second |
| Batch account deletion | 1 request/second |
| Account configuration updates | 10 requests/second |
Accounts per project
| Account type | Limit |
|---|---|
| Anonymous user accounts | 100 million |
| Registered user accounts | Unlimited |
Email sending limits
The quotas listed in this section scale with the size of their respective projects.
| Operation | Spark plan limit | Blaze plan limit |
|---|---|---|
| Address verification emails | 1000 emails/day | 100,000 emails/day |
| Address change emails | 1000 emails/day | 10,000 emails/day |
| Password reset emails | 150 emails/day | 10,000 emails/day |
| Email link sign-in emails | 5 emails/day | 25,000 emails/day |
Email link generation limits
The quotas listed in this section scale with the size of their respective projects.
| Operation | Spark plan limit | Blaze plan limit |
|---|---|---|
| Address verification links | 10,000 emails/day | 1,000,000 emails/day |
| Password reset links | 1500 emails/day | 100,000 emails/day |
| Sign-in links | 20,000 emails/day | 250,000 emails/day |
Phone number sign-in limits
| Operation | Limit |
|---|---|
| User sign-ins | 1600/project/minute, as well as the pricing and limits specified on the Pricing page |
| Verification code SMS messages |
Firebase Authentication, no cost (Spark): 50 SMS/day Firebase Authentication, pay as you go (Blaze): 3000 SMS/day limit Firebase Authentication with Identity Platform, no cost (Spark): 10 SMS/day Firebase Authentication with Identity Platform, pay as you go (Blaze): No limit |
| Verification requests | 150 requests/IP address/hour |
Verification SMS sending limits
| Operation | Limit |
|---|---|
| Verification SMS sent per project | 1,500 sent/minute |
| Verification SMS sent per IP address | 50 sent/minute, 500 sent/hour |
Additionally, there is a limit on the number of verification SMS messages a project can send to a single phone number within a set amount of time. You can test with fictional numbers or across multiple devices to ensure a project does not exceed these limits.
Additionally, you can track verification codes sent per phone number if you've enabled Activity Logging on your project.
Identity Toolkit API limits
| Operation | Limit |
|---|---|
| Operations per service account | 500 requests/second |
| Operations per project | 1000 requests/second, 10 million requests/day |
| Account uploads per project* | 3600 uploads/minute |
| Account downloads per project* | 21,000 requests/minute |
| UserInfo queries per project* | 900 requests/minute |
| Configuration updates per project* | 300 requests/minute |
| Configuration updates per project and user* | 300 requests/minute |
| Bulk delete accounts per project* | 3000 requests/minute |
| Custom token sign-ins per project | 45,000 sign-ins/minute |
createAuthURI calls per IP address |
120 requests/hour |
| Blocking function invocations per project | 2000 requests/minute |
* Admin-only operations.
The following methods leverage the createAuthURI endpoint:
- Client SDK:
fetchProvidersForEmail()andfetchSignInMethodsForEmail(email) - Admin SDK:
getUserByEmail()
Token Service API limits
| Operation | Limit |
|---|---|
| Token exchange per project | 18,000 exchanges/minute |