specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Passage by 1Password
providerId: passage-1password
created: '2026-06-20'
modified: '2026-06-20'
reconciled: false
tags:
- Authentication
- Passkeys
- WebAuthn
- Passwordless
- Identity
- Rate Limiting
- Quotas
- Throttling
description: >-
  The Passage Management API is authenticated with a per-app Bearer API key.
  Passage does not publish specific public per-endpoint rate-limit numbers;
  clients should expect standard abuse-prevention throttling on the
  api.passage.id surface and handle HTTP 429 responses with backoff. Specific
  RPM/RPD values are not reconciled in this artifact. NOTE - the Passage
  product is scheduled for retirement on 2026-01-16.
notes: >-
  No first-party rate-limit table is published for the Management API. Verify
  any limits with Passage / 1Password support on reconciliation; treat 429 as
  the throttling signal.
sources:
- https://docs.passage.id/api-docs/management-api
- https://docs.passage.id/home
responseCodes:
  throttled: 429
limits:
- name: Management API Requests
  scope: app
  metric: requests
  limit: see provider documentation
  notes: Per-app API-key throttling; specific numbers not published.
- name: Magic Link Creation
  scope: app
  metric: requests
  limit: see provider documentation
  notes: Abuse-prevention limits apply to magic link creation/send.
policies:
- name: Backoff Strategy
  description: Clients should implement exponential backoff with jitter and honor Retry-After on 429 responses.
- name: API Key Scoping
  description: Use a dedicated Management API key per app; rotate keys via the Passage Console.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com