Limits
The limits on sessions, phone numbers, requests and webhooks, and what happens when you reach them.
Limits protect end users from being pushed into repeat sends and keep the system stable. The values are settings that can change over time, so don't hard-code them.
| Limit | How it works | When reached |
|---|---|---|
| Session lifetime | Usually 5 minutes; read expires_at | A session.expired webhook arrives |
| Sessions per client | Sessions you can create per minute | 429 rate_limited |
| Sessions per phone | Sessions per number per hour (when you pass phone) | 429 rate_limited |
| Wrong-code senders | A number that sends 5 wrong SMS within an hour is throttled for a while. Re-sending the code of an already verified session does not count | Its messages are not matched |
| Live rules | Up to 5 per client (2fa.mn can raise it per client) | 409 rule_limit |
| Test SMS | Up to 30 POST /v1/test/mo per minute per client | 429 rate_limited |
metadata | A JSON object up to 4 KB | 400 invalid_request |
| Request body | Up to 64 KB | 400 invalid_request |
| Test SMS text | 1 to 640 characters | 400 invalid_request |
| Webhook response | 2xx within 10 seconds | Live webhooks are retried, at most 5 times. Test webhooks are not retried |
| Delivery log | GET /v1/webhook/deliveries returns the latest 100 |
When you get 429
- Retry with exponential backoff.
- Don't create a new session on every click; reuse a session that is still valid.
- Show the user a clear message such as "Please wait a moment and try again."
What's next
Was this page helpful?