API Reference
Rate Limiting
Authon APIs enforce per-endpoint rate limits to prevent abuse and ensure service stability. Exceeding a limit returns HTTP 429 Too Many Requests.
SDK Auth Endpoints
Endpoints called directly from your app. Base URL: POST https://api.authon.dev
| Method | Endpoint | Limit (count/window) |
|---|---|---|
| POST | /v1/auth/signup | 60 / 60s |
| POST | /v1/auth/signin | 60 / 60s |
| POST | /v1/auth/token/refresh | 120 / 60s |
| DELETE | /v1/auth/me | 10 / 60s |
| POST | /v1/auth/testing/token | 100 / 60s |
| GET | /v1/auth/token/verify | — |
| GET | /v1/auth/me | — |
| PATCH | /v1/auth/me | — |
| POST | /v1/auth/signout | — |
| GET | /v1/auth/branding | — |
Dashboard Auth Endpoints
Endpoints used for Authon dashboard login.
| Method | Endpoint | Limit (count/window) |
|---|---|---|
| POST | /v1/dashboard/auth/register | 20 / 60s |
| POST | /v1/dashboard/auth/login | 30 / 60s |
| POST | /v1/dashboard/auth/verify-email | 60 / 60s |
| POST | /v1/dashboard/auth/resend-code | 20 / 60s |
Error Response Format
// HTTP 429
{
"statusCode": 429,
"message": "ThrottlerException: Too Many Requests",
"error": "Too Many Requests"
}
Best Practices
- The SDK caches tokens in client memory. Avoid calling /token/verify directly on every request.
- Call /token/refresh only when the token is about to expire. Use the SDK's built-in auto-refresh logic.
- On receiving a 429, apply exponential backoff before retrying.
- Never use Testing Mode (/testing/token) in a production environment.