Firebase Authentication Limits

The following auth operations have limitations on the frequency you can performthem. ContactFirebase a few weeks in advanceto discuss special use cases.

Note: Limitations apply per customer and can change without notice. Abuse protections may be enabled without warning on accountsthat demonstrate suspicious traffic patterns.

Daily Instrumentless Usage Limits

The following limits are daily usage limits for users ofFirebase Authentication with Identity Platform on the no-cost Spark plan.These usage limits correspond directly toGoogle Cloud Pricing Tiers.

UsageInstrumentless Limit
Tier 1 Daily Active Users3000 per day
Tier 2 Daily Active Users2 per day

Account creation and deletion limits

OperationLimit
New account creation100 accounts/hour for each IP address
Account deletion10 accounts/second
Batch account deletion1 request/second
Account configuration updates10 requests/second
Note: You can schedule a temporary increase to the account creation limit in theFirebase console

Account limits

Account typeLimit
Anonymous user accounts100 million
Registered user accountsUnlimited

Email sending limits

The quotas listed in this section scale with the number of users.

OperationSpark plan limitBlaze plan limit
Address verification emails1000 emails/day100,000 emails/day
Address change emails1000 emails/day10,000 emails/day
Password reset emails150 emails/day10,000 emails/day
Email link sign-in emails5 emails/day25,000 emails/day
Note: The limits for email link sign-in emails were recently changed. Please add a billing instrument to go beyond 5 email link sign-in emails.

Email link generation limits

The quotas listed in this section scale with the number of users.

OperationSpark plan limitBlaze plan limit
Address verification links10,000 links/day1,000,000 links/day
Password reset links1500 links/day100,000 links/day
Sign-in links20,000 links/day250,000 links/day

Phone number sign-in limits

OperationLimit
User sign-ins1600/minute, as well as the pricing and limits specified on thePricing page
Verification code SMS messages

Pay as you go (Blaze) plan only.

  • Firebase Authentication: 3000 sent SMS/day limit
  • Firebase Authentication with Identity Platform: No limit
Verification requests150 requests/IP address/hour

Verification SMS sending limits

OperationLimit
Verification SMS sent.1,000 sent/minute
Verification SMS sent per IP address50 sent/minute, 500 sent/hour

Additionally, there is a limit on the number of verification SMS messages a projectcan send to a single phone number within a set amount of time. You can test withfictional numbers oracross multiple devices to ensure a project does not exceed these limits.

Additionally, you can track verification codes sent per phone number if you've enabledActivity Logging on your project.

Identity Toolkit API limits

OperationLimit
Operations per service account500 requests/second
Operations per project1000 requests/second, 10 million requests/day
Account uploads per project*3.6M accounts/minute
Account downloads per project*21,000 requests/minute
UserInfo queries per project*900 requests/minute
Configuration updates per project*300 requests/minute
Configuration updates per project and user*300 requests/minute
Bulk delete accounts per project*3000 requests/minute
Custom token sign-ins per project45,000 sign-ins/minute
createAuthURI calls per IP address120 requests/hour
Blocking function invocations per project2000 requests/minute
GetAccountInfo per project*500,000 requests/minute

* Admin-only operations.

ThefetchProvidersForEmail() andfetchSignInMethodsForEmail(email) methods leverage thecreateAuthURI endpoint.

Token Service API limits

OperationLimit
Token exchange per project18,000 exchanges/minute

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-03 UTC.