速率限制

Supabase Auth 会对身份验证端点执行速率限制，以防止滥用。一些速率限制是可以自定义的，你可以在你的项目中 身份验证 > 速率限制 进行配置。

🌐 Supabase Auth enforces rate limits on authentication endpoints to prevent abuse. Some rate limits are customizable, and you can configure them in your project Authentication > Rate Limits.

你也可以用管理 API 来管理速率限制：

🌐 You can also manage rate limits using the Management API:

1
# Get your access token from https://supabase.nodejs.cn/dashboard/account/tokens
2
export SUPABASE_ACCESS_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Get current rate limits
6
curl -X GET "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
7
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
8
  | jq 'to_entries | map(select(.key | startswith("rate_limit_"))) | from_entries'
9
10
# Update rate limits
11
curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
12
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
13
  -H "Content-Type: application/json" \
14
  -d '{
15
    "rate_limit_anonymous_users": 10,
16
    "rate_limit_email_sent": 10,
17
    "rate_limit_sms_sent": 10,
18
    "rate_limit_verify": 10,
19
    "rate_limit_token_refresh": 10,
20
    "rate_limit_otp": 10,
21
    "rate_limit_web3": 10
22
  }'

速率限制行为 #

🌐 Rate limit behavior

Supabase Auth 对受 IP 地址限制的端点操作使用令牌桶算法。

🌐 Supabase Auth uses a token bucket algorithm for endpoint operations that are limited by IP address.

大多数桶的最大容量是 30 个请求。当桶已满时，可以在短时间内允许最多 30 个请求的短暂突发。匿名登录是个例外：桶容量与每小时配置的匿名登录次数相匹配。一旦桶空了，请求就会受到速率限制，直到令牌补充。速率限制定义了桶的补充速度。

🌐 Most buckets have a maximum capacity of 30 requests. When a bucket is full, brief bursts of up to 30 requests can be allowed in a short period. Anonymous sign-ins are an exception: the bucket capacity matches the configured number of anonymous sign-ins per hour. Once a bucket empties, requests are rate limited until tokens refill. The rate limit defines the rate at which the bucket is refilled.

这意味着闲置的客户端可以容忍短时间的流量高峰，但持续超过速率限制的请求会被拒绝。当超过速率限制时，会返回 429 请求过多 错误。

🌐 This means a client that has been idle will tolerate a brief spike in traffic, but sustained requests above the rate limit are denied. When rate limits are exceeded, a 429 Too Many Requests error is returned.

下表显示了身份验证端点的速率限制配额和其他详细信息。

🌐 The table below shows the rate limit quotas and additional details for authentication endpoints.

IP地址转发 #

🌐 IP address forwarding

默认情况下，Supabase Auth 使用客户端的 IP 地址来进行速率限制。在某些情况下，比如使用服务端框架或在项目前面放置代理时，可能需要转发终端用户的 IP 地址，以避免根据服务端客户端的地址被限流。要在 Supabase Auth 中使用转发的 IP 地址进行速率限制，请将 Sb-Forwarded-For 头设置为终端用户的 IP 地址，并使用 密钥 API 发起请求。可公开的 API 密钥和旧版 anon/service_role API 密钥不支持此操作。

🌐 By default, Supabase Auth uses the IP address of the client for rate limiting. In certain cases, such as when using server-side frameworks or proxies in front of a project, it may be necessary to forward the end-user IP address to avoid being rate limited based on the address of the server-side client. To use a forwarded IP address for rate limiting in Supabase Auth, set the Sb-Forwarded-For header to the end-user IP address and make a request with a secret API key. Publishable API keys and legacy anon/service_role API keys are not supported.

新项目必须明确启用 IP 地址转发。你可以在项目的速率限制设置中的 IP 地址转发 部分启用此功能，路径为 认证 > 速率限制。

🌐 IP address forwarding must be explicitly enabled for new projects. You can enable this feature in your project under the IP Address Forwarding section of your project's rate limit settings at Authentication > Rate Limits.

你也可以使用管理 API 启用 IP 地址转发：

🌐 You can also enable IP address forwarding using the management API:

1
# Get your access token from https://supabase.nodejs.cn/dashboard/account/tokens
2
export SUPABASE_ACCESS_TOKEN="your-access-token"
3
export PROJECT_REF="your-project-ref"
4
5
# Update IP address forwarding settings
6
curl -X PATCH "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth" \
7
     -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
8
     -H "Content-Type: application/json" \
9
     -d '{
10
      "security_sb_forwarded_for_enabled": true
11
        }' \
12
    | jq '.security_sb_forwarded_for_enabled'

一旦启用 IP 地址转发，就可以使用 Supabase SDK 设置 Sb-Forwarded-For 头了：

🌐 Once IP address forwarding is enabled, set the Sb-Forwarded-For header using the Supabase SDK:

1
import { createServerClient } from '@supabase/ssr'
2
3
const supabase = createServerClient(
4
  'https://<your-project-id>.supabase.co',
5
  '<your-secret-key>', // Key should start with sb_secret
6
  {
7
    global: {
8
      headers: {
9
        'sb-forwarded-for': request.headers.get('x-forwarded-for'),
10
      },
11
    },
12
  }
13
)