Is REST login rate-limited?

wedwards · August 2, 2026, 12:31pm

Is /rest/login rate-limited? On Deployment | Deploy | n8n Docs I only see options for rate-limiting OAuth (e.g. N8N_MCP_SERVER_RATE_LIMIT).

n8n · August 2, 2026, 12:31pm

Hey @wedwards, while you wait for a response, here are some things that might help:

Suggested resources

Automatically matched to your question.

Docs:

Forum:

@Zelite, @fahmiiireza - you’ve helped with similar issues before, can you take a look?

Automatically suggested by n8n’s community bot. It’s a pilot - please share feedback here.

kjooleng · August 2, 2026, 12:36pm

Hi @wedwards

The OAuth/MCP rate-limit env vars you see on the Deployment page cover only the OAuth server and MCP endpoints, not the login endpoint.

Only these are covered

wedwards · August 2, 2026, 1:23pm

Yes, hence my question

kjooleng · August 2, 2026, 1:29pm

For me the answer would be no

Anshul_Namdev · August 2, 2026, 1:54pm

Hi @wedwards
Yes. /rest/login has two rate limiters declared on the route itself rather than in config, which is why no env var shows up for it: 1000 requests per IP per 5 minutes, and 5 requests per minute keyed on the submitted emailOrLdapLoginId. Going over either returns a 429, and there is no supported setting to raise or disable them. If you are calling it programmatically, log in once and reuse the session cookie, or use an API key for machine-to-machine calls.

github.com/n8n-io/n8n

packages/cli/src/controllers/auth.controller.ts

master

import { LoginRequestDto, ResolveSignupTokenQueryDto } from '@n8n/api-types';
import { Logger } from '@n8n/backend-common';
import { Time } from '@n8n/constants';
import type { User, PublicUser, AuthProviderType } from '@n8n/db';
import { UserRepository, AuthenticatedRequest, GLOBAL_OWNER_ROLE } from '@n8n/db';
import {
	Body,
	createBodyKeyedRateLimiter,
	Get,
	Post,
	Query,
	RestController,
} from '@n8n/decorators';
import { isEmail } from 'class-validator';
import { Response } from 'express';

import { AuthHandlerRegistry } from '@/auth/auth-handler.registry';
import { AuthService } from '@/auth/auth.service';
import { RESPONSE_ERROR_MESSAGES } from '@/constants';
import { AuthError } from '@/errors/response-errors/auth.error';

This file has been truncated. show original

nguyenthieutoan · August 2, 2026, 3:53pm

It actually is rate-limited, just not through those OAuth/MCP env vars. /rest/login has built-in brute-force protection that throttles to 5 attempts per minute per email address, and there’s no documented env var to raise or disable it since n8n treats it as a hardcoded security control rather than a configurable option. If you’re hitting this from an automated client, switch to an API key (Settings > API, sent as the X-N8N-API-KEY header) instead of repeated /rest/login calls, since API key auth isn’t subject to this limit. Test by sending 6+ rapid requests to /rest/login with a wrong password and confirming you get a 429 on the 6th.

Topic		Replies	Views
Getting 429 error whille invoking the n8n /login api Questions	7	171	June 1, 2026
Authentication required to access /rest/login? Questions core , deployment	3	922	August 17, 2023
Handling rate limiting Questions	1	1434	January 9, 2020
How do I deal with API rate limits in n8n Questions	1	128	November 30, 2025
Rate limit capability for nodes Feature Requests	3	2585	July 20, 2022

Is REST login rate-limited?

Related topics