Skip to content

Login throttling

If you see "Too many login attempts. Retry after Xs" or get a 429 response on the login page, your account or IP has been temporarily rate-limited. This is the same protection your workspace gets against password-guessing.

What triggers it

  • Repeated wrong passwords on the login page.
  • Repeated wrong authenticator codes (or recovery codes) on the MFA verification page - but only within the same short-lived MFA ticket. Crossing the per-ticket cap also invalidates that ticket and routes you back to the login page.
  • Repeated forgot-password or registration submissions from the same IP in a short window.

How long the cooldown lasts

The exact cap and cooldown are configured by Patcherly; the current defaults are:

  • Login: three failed attempts within a five-minute window engage a ten-minute lockout. Until then, wrong email/password shows a credentials error with a short soft backoff (not a lockout message). Each failed attempt also pays that backoff so a script slows down before it ever reaches the lockout.
  • MFA verify / recovery: five wrong codes per ticket invalidate the ticket. Restart sign-in from the login page.
  • Forgot-password / registration: capped per IP per hour. The default is 10 forgot-password requests and 20 registration attempts per hour per IP.

The Retry-After header on the API response tells you the exact remaining seconds; the dashboard counts it down for you.

What you can do

  • Wait it out. Cooldowns are short and clear automatically.
  • Verify Caps Lock / keyboard layout / autofill before the next attempt - every failed attempt adds to the counter.
  • Use the recovery flow instead of guessing your password.
  • Open Support from the bottom of the dashboard sidebar if the lockout pattern looks suspicious or persistent - we can review login activity on Patcherly's side (workspace Audit does not show interactive logins or MFA events).

Why this exists

Without throttling, an attacker who knows or guesses your email could run an automated password attack against the login page at network speed. The per-IP and per-attempt caps make password-guessing economically uninteresting and help Patcherly detect obvious abuse.