Too many sign-in attempts — try again later
Login IP/user rate limit tripped (AUTH_RATE_LIMIT_LOGIN). Also returned from OAuth provider start when attempts are too frequent. Product: try again later.
Why this happens
Anti-brute-force on POST /api/auth/login (and OAuth start). Distinct from captcha-required (Too many failed sign-in attempts — complete the captcha) and from IP ban (Too many failed attempts — your IP has been banned).
Diagnose and fix
1. Wait; respect Retry-After / retryAfterSec if shown.
2. Use correct credentials or forgot-password instead of rapid retries.
3. Admin: review Max login attempts per hour and related thresholds.
4. Shared NAT may hit limits faster — wait or use another network.