<commit_before>---
name: Rate Limiting in the Appliance
description: How to enable, configure, and test for rate limiting in the Appliance
---
# Appliance: Rate Limiting

Beginning with Appliance build `6576`, rate limits for API endpoints can be enabled and configured in the Dashboard. Rate limiting in the Appliance is done using [limitd](https://github.com/limitd/limitd#buckets).

## Enable and Configure Rate Limiting

In the Appliance Dashboard, go to **Rate Limiting**.

![](/media/articles/appliance/admin/rate-limiting-1.png)

Click the checkbox next to **Enable** to enable rate limiting.

![](/media/articles/appliance/admin/rate-limiting-2.png)

By default, **Configuration of buckets** is empty, which means that limitd's default configuration will be used. You can, however, [customize your buckets](https://github.com/auth0/limitd#buckets).

Click **Save** and wait for the updates to the configuration to complete.

![](/media/articles/appliance/admin/rate-limiting-3.png)

## Test Rate Limiting Functionality

When you've enabled rate limiting, the HTTP response includes the following headers:

* X-RateLimit-Limit: Request limit
* X-RateLimit-Remaining: Requests available for the current time frame
* X-RateLimit-Reset: Time until the rate limit resets (in UTC [epoch seconds](https://en.wikipedia.org/wiki/Unix_time))

To verify that rate limiting is working, you can send a call to the [`/oauth/ro` endpoint](/api/authentication#resource-owner):

```text
POST /oauth/ro HTTP 1.1
Content-Type: application/json
{
  "grant_type": "password",
  "client_id": "123",<commit_msg>Remove customization<commit_after>---
name: Rate Limiting in the Appliance
description: How to enable, configure, and test for rate limiting in the Appliance
---
# Appliance: Rate Limiting

Beginning with Appliance build `6576`, rate limits for API endpoints can be enabled and configured in the Dashboard. Rate limiting in the Appliance is done using [limitd](https://github.com/limitd/limitd#buckets).

## Enable and Configure Rate Limiting

In the Appliance Dashboard, go to **Rate Limiting**.

![](/media/articles/appliance/admin/rate-limiting-1.png)

Click the checkbox next to **Enable** to enable rate limiting.

![](/media/articles/appliance/admin/rate-limiting-2.png)

By default, **Configuration of buckets** is empty, which means that limitd's default configuration will be used. Your Customer Success Engineer may advise you to adjust this value if appropriate.

Click **Save** and wait for the updates to the configuration to complete.

![](/media/articles/appliance/admin/rate-limiting-3.png)

## Test Rate Limiting Functionality

When you've enabled rate limiting, the HTTP response includes the following headers:

* X-RateLimit-Limit: Request limit
* X-RateLimit-Remaining: Requests available for the current time frame
* X-RateLimit-Reset: Time until the rate limit resets (in UTC [epoch seconds](https://en.wikipedia.org/wiki/Unix_time))

To verify that rate limiting is working, you can send a call to the [`/oauth/ro` endpoint](/api/authentication#resource-owner):

```text
POST /oauth/ro HTTP 1.1
Content-Type: application/json
{
  "grant_type": "password",
  "client_id": "123",
{'fraction_non_alphanumeric': 0.10603690960275258, 'fraction_numerical': 0.00781983109164842, 'mean_word_length': 4.900369003690037, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 5, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7474596', 'n_tokens_mistral': 954, 'n_tokens_neox': 890, 'n_words': 357}