Magic link rate limits

Why magic-link requests are rate limited and how operators recover.

Why limits exist

Magic-link issuance is rate limited in durable storage so attackers cannot flood inboxes or brute-force email entry points. Limits protect both the email provider and D1 write volume. Hitting a limit is often a sign of retries, not a broken product.

What you should do

Wait for the window to clear before requesting another link. Use the latest email only. Do not script login against production without a dedicated test path. Local e2e may use AUTH_DEV_OUTBOX=1 to read links without SMTP — never enable that as a production default.

  1. Stop repeated clicks on Request link for a few minutes.
  2. Check the inbox and spam for the most recent SpeakerOps message.
  3. Open the latest link once in a fresh browser tab.
  4. If still blocked, ask an admin to confirm allowlist and host health.

Admin checks

Verify EMAIL provider configuration, queue drain for auth.magic_link jobs, and that BOOTSTRAP_ADMIN_EMAIL or allowlist entries match the operator address. Check /health on the Worker for basic liveness.