Account Lockout

Autentico tracks consecutive failed login attempts and locks the account temporarily after a configurable threshold. This limits the effectiveness of brute-force and credential stuffing attacks.

How it works

Each failed password attempt increments failed_login_attempts on the user record
When failed_login_attempts reaches account_lockout_max_attempts, the account is locked by setting locked_until = now + account_lockout_duration
Login attempts while the account is locked return an error immediately (no password check)
The counter resets to 0 on a successful login

Configuration

Setting	Default	Description
`account_lockout_max_attempts`	`5`	Number of consecutive failures before lockout
`account_lockout_duration`	`15m`	How long the account stays locked

Update via Admin UI (Settings) or API:

curl -X PUT https://auth.example.com/admin/api/settings \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"account_lockout_max_attempts": 10, "account_lockout_duration": "30m"}'

Unlocking accounts

Locked accounts unlock automatically when locked_until passes. To unlock immediately:

Admin UI: Users → (user) → Unlock

API:

curl -X POST https://auth.example.com/admin/api/users/USER_ID/unlock \
  -H "Authorization: Bearer $ADMIN_TOKEN"

Unlocking resets failed_login_attempts to 0 and clears locked_until.

ROPC grant

Account lockout applies to ROPC (Resource Owner Password Credentials) token requests as well as browser-based logins.