diff --git a/docs/admin/realm-settings.md b/docs/admin/realm-settings.md
index 4024d9b8..b90ce89f 100644
--- a/docs/admin/realm-settings.md
+++ b/docs/admin/realm-settings.md
@@ -30,6 +30,9 @@ The page currently has these tabs:
   identification by HTTPS-URL `client_id` (linked detail page:
   [Client ID Metadata Documents](./client-id-metadata-documents)).
   Off by default.
+- **Native Passwordless Grants** — the per-realm master toggle for the
+  cookieless `urn:cocoar:*` grants (see [Native app integration](../integrate/native-apps))
+- [Rate Limits](#rate-limits) — per-IP request ceilings for the realm's auth endpoints
 - [Account Deletion](#account-deletion) — grace period and recycle-bin retention policy
 - [Signing Keys](#signing-keys) — rotate the realm's OAuth/OIDC token-signing key
 
@@ -168,6 +171,28 @@ Off by default. See the full feature page for when to enable it, what gets accep
 
 → **[Dynamic Client Registration](./dynamic-client-registration)** (full feature page)
 
+## Rate Limits
+
+Per-IP request ceilings for this realm's auth endpoints. Each policy is a **max requests / window (minutes)** pair, partitioned by source IP and applied **per realm**. The shipped defaults are the secure production posture — the knob exists so a test realm, dev, or a legitimately bursty consumer can raise a ceiling **without a modgud code change + redeploy**, and so a hardened realm can tighten one.
+
+| Policy | Endpoint | Default |
+| --- | --- | --- |
+| Native OTP request | `POST /api/account/native/otp/request` (+ native register) | 5 / 60 min |
+| Magic-link request | `POST /api/account/magic-link/request` | 5 / 60 min |
+| Password-reset request | `POST /api/account/forgot-password` | 5 / 60 min |
+| Email-OTP login verify | `POST /api/account/email-otp/login` | 30 / 1 min |
+| Email verification resend | `POST /api/account/email/send-verification` | 5 / 60 min |
+| Passkey ceremony begin / enroll | `POST /connect/passkey/begin` (+ enroll) | 60 / 5 min |
+| First-admin bootstrap | `POST /api/account/bootstrap-admin` | 10 / 15 min |
+
+Notes:
+
+- A realm that never touches this tab behaves exactly as before — the defaults are the previously-hardcoded values.
+- Limits are **per realm**: raising a ceiling on one realm does not affect another on the same shared IdP.
+- The limiter is in-memory and resets on app restart; over-limit requests get `429 Too Many Requests`.
+- A config change takes effect within a few seconds (a short cache smooths the per-request lookup).
+- This governs the **request rate**; it is independent of per-challenge attempt counters (e.g. the email-OTP `MaxAttempts` brute-force lock) and of the realm's anti-enumeration uniform responses.
+
 ## Account Deletion
 
 Controls the account-deletion lifecycle for this realm — the self-service grace period and the admin recycle-bin retention. These replace the old hardcoded 7-day confirm-token window. The mechanics of both flows are documented under [Users → recycle bin & permanent erase](./users#recycle-bin-permanent-erase) and [Profile → Privacy](../end-user/profile#privacy).
diff --git a/docs/integrate/native-apps.md b/docs/integrate/native-apps.md
index f2737ad7..cc72ea85 100644
--- a/docs/integrate/native-apps.md
+++ b/docs/integrate/native-apps.md
@@ -292,7 +292,7 @@ From then on, the app uses **Flow 3 (passkey)** as the steady-state login.
 | Client lacks the `gt:urn:cocoar:*` permission | `unauthorized_client` |
 | Wrong/expired code, link, or passkey assertion | `invalid_grant` — **uniform** message + jitter (anti-enumeration); don't parse it for "which part was wrong" |
 | TOTP required but missing/invalid (OTP & magic flows) | `invalid_grant` ("Two-factor authentication is required; supply totp_code.") |
-| Rate limit hit (OTP request, passkey begin, token endpoint) | `429 Too Many Requests` — back off |
+| Rate limit hit (OTP request, passkey begin, token endpoint) | `429 Too Many Requests` — back off. The per-IP ceilings are realm-configurable under [Realm Settings → Rate Limits](../admin/realm-settings#rate-limits) (defaults unchanged). |
 | Passkey begin while realm has no primary domain | `503` (admin must set the realm/client RP-ID) |
 
 ### Discovery
diff --git a/src/dotnet/Modgud.Api.Tests/Authorization/AuthRateLimitConfigTests.cs b/src/dotnet/Modgud.Api.Tests/Authorization/AuthRateLimitConfigTests.cs
new file mode 100644
index 00000000..e8e5c839
--- /dev/null
+++ b/src/dotnet/Modgud.Api.Tests/Authorization/AuthRateLimitConfigTests.cs
@@ -0,0 +1,86 @@
+using System.Net;
+using System.Net.Http.Json;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Modgud.Api.Tests.Infrastructure;
+using Modgud.Application.DTOs.RealmSettings;
+using Modgud.Authentication.RealmSettings;
+
+namespace Modgud.Api.Tests.Authorization;
+
+/// <summary>
+/// Verifies the per-realm configurable auth rate-limit ceilings actually drive the
+/// live ASP.NET limiter (native-otp policy as the representative case). A realm that
+/// lowers the limit gets throttled sooner; one that raises it past the shipped
+/// default (5/h) is allowed more. The limit is resolved per request from the realm's
+/// AuthRateLimits via AuthRateLimitResolutionMiddleware (TTL=0 in Testing, so a patch
+/// takes effect immediately). Requests share one budget via the X-Test-RateLimit
+/// header — distinct per test so the limit value baked into the partition key keeps
+/// the two tests isolated.
+/// </summary>
+[Collection(IntegrationTestCollection.Name)]
+public class AuthRateLimitConfigTests : IntegrationTestBase
+{
+    public AuthRateLimitConfigTests(SharedPostgresFixture fixture) : base(fixture) { }
+
+    [Fact]
+    public async Task LoweredNativeOtpLimit_ThrottlesSooner()
+    {
+        await SetNativeOtpLimitAsync(permitLimit: 2, windowMinutes: 60);
+        var anon = Factory.CreateClient();
+
+        // With the ceiling lowered to 2, the first two pass the limiter and the
+        // third is throttled — proving the realm override drives the live limiter.
+        for (var i = 1; i <= 2; i++)
+        {
+            var passed = await SendAsync(anon, "lowered", $"probe{i}@nowhere.example");
+            Assert.NotEqual(HttpStatusCode.TooManyRequests, passed.StatusCode);
+        }
+
+        var rejected = await SendAsync(anon, "lowered", "probe-over@nowhere.example");
+        Assert.Equal(HttpStatusCode.TooManyRequests, rejected.StatusCode);
+    }
+
+    [Fact]
+    public async Task RaisedNativeOtpLimit_AllowsPastShippedDefault()
+    {
+        // Raise the ceiling well past the shipped default of 5/h.
+        await SetNativeOtpLimitAsync(permitLimit: 20, windowMinutes: 60);
+        var anon = Factory.CreateClient();
+
+        // Six requests — one more than the old hardcoded default — must all pass the
+        // limiter. Under the un-raised 5/h ceiling the sixth would have been 429.
+        for (var i = 1; i <= 6; i++)
+        {
+            var passed = await SendAsync(anon, "raised", $"probe{i}@nowhere.example");
+            Assert.NotEqual(HttpStatusCode.TooManyRequests, passed.StatusCode);
+        }
+    }
+
+    private async Task SetNativeOtpLimitAsync(int permitLimit, int windowMinutes)
+    {
+        using var scope = Factory.Services.CreateScope();
+        scope.ServiceProvider.GetRequiredService<IHttpContextAccessor>()
+            .HttpContext = new DefaultHttpContext { Items = { ["TenantId"] = "system" } };
+        var settings = scope.ServiceProvider.GetRequiredService<IRealmSettingsService>();
+        var result = await settings.PatchAsync(new UpdateRealmSettingsDto
+        {
+            AuthRateLimits = new UpdateAuthRateLimitsDto
+            {
+                NativeOtp = new RateLimitRuleDto { PermitLimit = permitLimit, WindowMinutes = windowMinutes },
+            },
+        }, TestContext.Current.CancellationToken);
+        Assert.False(result.IsError);
+    }
+
+    private static Task<HttpResponseMessage> SendAsync(HttpClient client, string budget, string email)
+    {
+        var req = new HttpRequestMessage(HttpMethod.Post, "/api/account/native/otp/request")
+        {
+            Content = JsonContent.Create(new { Email = email }),
+        };
+        // Shared budget so the requests partition together; distinct per test.
+        req.Headers.Add("X-Test-RateLimit", $"auth-rl-config-{budget}");
+        return client.SendAsync(req, TestContext.Current.CancellationToken);
+    }
+}
diff --git a/src/dotnet/Modgud.Api/Middleware/AuthRateLimitResolutionMiddleware.cs b/src/dotnet/Modgud.Api/Middleware/AuthRateLimitResolutionMiddleware.cs
new file mode 100644
index 00000000..4f3c446d
--- /dev/null
+++ b/src/dotnet/Modgud.Api/Middleware/AuthRateLimitResolutionMiddleware.cs
@@ -0,0 +1,76 @@
+using System.Collections.Concurrent;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.Extensions.Hosting;
+using Modgud.Authentication.RealmSettings;
+using Modgud.Domain.Realms;
+using Modgud.Infrastructure.Persistence.Tenancy;
+
+namespace Modgud.Api.Middleware;
+
+/// <summary>
+/// Bridges the per-realm auth rate-limit config into the ASP.NET rate limiter.
+///
+/// <para>The limiter's policy factories (<c>AddPolicy(...)</c> in <c>Program.cs</c>)
+/// run synchronously and cannot resolve the realm's configured ceilings (an async
+/// Marten lookup). This middleware does that lookup once per request — after
+/// <c>RealmMiddleware</c> has resolved the tenant and before <c>UseRateLimiter</c> —
+/// and stashes the realm's <see cref="AuthRateLimitSettings"/> on
+/// <see cref="HttpContext.Items"/> under <see cref="ItemsKey"/>, where the factories
+/// read it. Absent (e.g. an endpoint that doesn't rate-limit, or a resolution
+/// failure) ⇒ the factory falls back to the shipped <see cref="AuthRateLimitDefaults"/>.</para>
+///
+/// <para>It only does the lookup for endpoints that actually opt into a limiter
+/// policy (<see cref="EnableRateLimitingAttribute"/> metadata), and caches the
+/// per-realm result for a few seconds so a flood against an anonymous auth endpoint
+/// doesn't turn each would-be-throttled request into a fresh DB hit — keeping the
+/// limiter's cheap-rejection property. Config edits take effect within the TTL.</para>
+/// </summary>
+public sealed class AuthRateLimitResolutionMiddleware(RequestDelegate next, IHostEnvironment env)
+{
+    public const string ItemsKey = "Modgud.AuthRateLimits";
+
+    // No cache in Testing — each request reloads so a PATCH to the realm's limits
+    // takes effect immediately and rate-limit tests are deterministic. In every
+    // other environment a short TTL keeps the limiter's cheap-rejection property
+    // under flood; config edits take effect within the window.
+    private readonly TimeSpan _cacheTtl =
+        env.IsEnvironment("Testing") ? TimeSpan.Zero : TimeSpan.FromSeconds(10);
+
+    // realm slug → (expiry, settings). One instance for the app lifetime, so the
+    // cache is process-wide. A null Value is a legitimately-cached "no overrides".
+    private readonly ConcurrentDictionary<string, CacheEntry> _cache = new(StringComparer.Ordinal);
+
+    private readonly record struct CacheEntry(DateTimeOffset Expires, AuthRateLimitSettings? Value);
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        if (context.GetEndpoint()?.Metadata.GetMetadata<EnableRateLimitingAttribute>() is not null)
+        {
+            var slug = context.Items[TenantConstants.HttpContextTenantIdKey] as string
+                       ?? TenantConstants.SystemTenantId;
+
+            if (!_cache.TryGetValue(slug, out var entry) || entry.Expires <= DateTimeOffset.UtcNow)
+            {
+                try
+                {
+                    var realmSettings = context.RequestServices.GetRequiredService<IRealmSettingsService>();
+                    var doc = await realmSettings.LoadAsync(context.RequestAborted);
+                    entry = new CacheEntry(DateTimeOffset.UtcNow + _cacheTtl, doc.AuthRateLimits);
+                    if (_cacheTtl > TimeSpan.Zero) _cache[slug] = entry;
+                }
+                catch
+                {
+                    // Tenant not resolved / DB hiccup: leave Items unset so the
+                    // policy factory uses the shipped defaults. Never block the
+                    // request on a settings-resolution failure.
+                    entry = default;
+                }
+            }
+
+            if (entry.Expires != default)
+                context.Items[ItemsKey] = entry.Value;
+        }
+
+        await next(context);
+    }
+}
diff --git a/src/dotnet/Modgud.Api/Program.cs b/src/dotnet/Modgud.Api/Program.cs
index 852c30da..5cd24c0e 100644
--- a/src/dotnet/Modgud.Api/Program.cs
+++ b/src/dotnet/Modgud.Api/Program.cs
@@ -37,6 +37,7 @@
 using Modgud.Api.Features.Users;
 using Modgud.Api.Helper;
 using Modgud.Domain.Common;
+using AuthRateLimitPolicy = Modgud.Domain.Realms.AuthRateLimitPolicy;
 using Modgud.Authentication.Domain;
 using Modgud.Infrastructure;
 using Modgud.Infrastructure.OAuth;
@@ -518,112 +519,31 @@
                 });
         });
 
-        options.AddPolicy("bootstrap", context =>
-        {
-            var key = PerIpRateLimitPartitionKey(context, isTestEnv);
-            return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
-                partitionKey: key,
-                factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
-                {
-                    PermitLimit = 10,
-                    Window = TimeSpan.FromMinutes(15),
-                    QueueLimit = 0,
-                });
-        });
-
-        options.AddPolicy("password-reset", context =>
-        {
-            var key = PerIpRateLimitPartitionKey(context, isTestEnv);
-            return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
-                partitionKey: key,
-                factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
-                {
-                    PermitLimit = 5,
-                    Window = TimeSpan.FromHours(1),
-                    QueueLimit = 0,
-                });
-        });
-
-        options.AddPolicy("magic-link", context =>
-        {
-            var key = PerIpRateLimitPartitionKey(context, isTestEnv);
-            return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
-                partitionKey: key,
-                factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
-                {
-                    PermitLimit = 5,
-                    Window = TimeSpan.FromHours(1),
-                    QueueLimit = 0,
-                });
-        });
-
-        // Email-verification (re)send — same bucket sizing as magic-link.
-        // Covers both authenticated 1-click and the anonymous self-service
-        // form; the endpoint itself returns a generic response either way.
-        options.AddPolicy("email-verification", context =>
-        {
-            var key = PerIpRateLimitPartitionKey(context, isTestEnv);
-            return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
-                partitionKey: key,
-                factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
-                {
-                    PermitLimit = 5,
-                    Window = TimeSpan.FromHours(1),
-                    QueueLimit = 0,
-                });
-        });
-
-        // Audit #24 — email-OTP code VERIFY. The endpoint is anonymous (partial-2FA
-        // state) and the per-challenge MaxAttempts counter is the only other
-        // brute-force defense; without a request cap, a concurrent burst that all
-        // read Attempts=0 before any increment commits could evaluate many guesses
-        // against the 6-digit code before the lockout trips. A per-IP fixed window
-        // bounds that burst. Sized well above any legitimate verify cadence.
-        options.AddPolicy("email-otp", context =>
-        {
-            var key = PerIpRateLimitPartitionKey(context, isTestEnv);
-            return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
-                partitionKey: key,
-                factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
-                {
-                    PermitLimit = 30,
-                    Window = TimeSpan.FromMinutes(1),
-                    QueueLimit = 0,
-                });
-        });
-
-        // ADR-0010 native passwordless OTP request — anonymous email-sending
-        // endpoint, same per-IP SMTP cap class as magic-link (5/hour). The
-        // dedicated boundary test sets X-Test-RateLimit to share a budget on
-        // purpose and assert the 429 (see PerIpRateLimitPartitionKey).
-        options.AddPolicy("native-otp", context =>
-        {
-            var key = PerIpRateLimitPartitionKey(context, isTestEnv);
-            return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
-                partitionKey: key,
-                factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
-                {
-                    PermitLimit = 5,
-                    Window = TimeSpan.FromHours(1),
-                    QueueLimit = 0,
-                });
-        });
-
-        // ADR-0010 Phase 2 — anonymous passkey "begin" endpoint. Cheap (no email/
-        // SMTP, just a challenge + a single-use ceremony doc), so more generous
-        // than native-otp; still per-IP bounded to cap ceremony-doc spam.
-        options.AddPolicy("passkey-begin", context =>
-        {
-            var key = PerIpRateLimitPartitionKey(context, isTestEnv);
-            return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
-                partitionKey: key,
-                factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
-                {
-                    PermitLimit = 60,
-                    Window = TimeSpan.FromMinutes(5),
-                    QueueLimit = 0,
-                });
-        });
+        // The per-IP auth limiters below now read their ceiling per request from
+        // the realm's configured AuthRateLimits (resolved by
+        // AuthRateLimitResolutionMiddleware, falling back to AuthRateLimitDefaults).
+        // The default values are unchanged from the previously-hardcoded ones — a
+        // realm that never touches the feature behaves exactly as before. See
+        // AuthFixedWindow for the realm+limit-aware partition key.
+        options.AddPolicy("bootstrap", context => AuthFixedWindow(context, AuthRateLimitPolicy.Bootstrap, isTestEnv));
+        options.AddPolicy("password-reset", context => AuthFixedWindow(context, AuthRateLimitPolicy.PasswordReset, isTestEnv));
+        options.AddPolicy("magic-link", context => AuthFixedWindow(context, AuthRateLimitPolicy.MagicLink, isTestEnv));
+        // Email-verification (re)send. Covers both authenticated 1-click and the
+        // anonymous self-service form; the endpoint returns a generic response either way.
+        options.AddPolicy("email-verification", context => AuthFixedWindow(context, AuthRateLimitPolicy.EmailVerification, isTestEnv));
+        // Audit #24 — email-OTP code VERIFY. Anonymous (partial-2FA state); the
+        // per-challenge MaxAttempts counter is the only other brute-force defense,
+        // so a per-IP window bounds a concurrent guess burst. Default sized well
+        // above any legitimate verify cadence (30/min).
+        options.AddPolicy("email-otp", context => AuthFixedWindow(context, AuthRateLimitPolicy.EmailOtp, isTestEnv));
+        // ADR-0010 native passwordless OTP request — anonymous email-sending endpoint
+        // (default 5/hour). The dedicated boundary test sets X-Test-RateLimit to share
+        // a budget on purpose and assert the 429 (see PerIpRateLimitPartitionKey).
+        options.AddPolicy("native-otp", context => AuthFixedWindow(context, AuthRateLimitPolicy.NativeOtp, isTestEnv));
+        // ADR-0010 Phase 2 — anonymous passkey "begin" endpoint. Cheap (no email/SMTP,
+        // just a challenge + a single-use ceremony doc), so a more generous default
+        // (60/5min); still per-IP bounded to cap ceremony-doc spam.
+        options.AddPolicy("passkey-begin", context => AuthFixedWindow(context, AuthRateLimitPolicy.PasskeyBegin, isTestEnv));
     });
 
     builder.Services.AddHttpContextAccessor();
@@ -1242,6 +1162,10 @@
     // (see /connect/* + /api/account/bootstrap-admin + /api/account/forgot-password +
     // /api/account/magic-link below). Endpoints without an explicit
     // policy are not rate-limited at the app layer.
+    // Resolve the realm's configured auth rate-limit ceilings and stash them on
+    // HttpContext.Items BEFORE the limiter runs, so the (synchronous) policy
+    // factories can read per-realm limits. Runs after RealmMiddleware (tenant set).
+    app.UseMiddleware<Modgud.Api.Middleware.AuthRateLimitResolutionMiddleware>();
     app.UseRateLimiter();
 
     // Observability surface: /metrics (Prometheus scrape) + /health/live +
@@ -1696,3 +1620,37 @@ static string PerIpRateLimitPartitionKey(HttpContext context, bool isTestEnv)
     var shared = context.Request.Headers["X-Test-RateLimit"].ToString();
     return string.IsNullOrEmpty(shared) ? Guid.NewGuid().ToString("N") : shared;
 }
+
+/// <summary>
+/// Builds a per-IP fixed-window partition whose ceiling comes from the realm's
+/// configured <see cref="Modgud.Domain.Realms.AuthRateLimitSettings"/> (stashed on
+/// Items by <see cref="Modgud.Api.Middleware.AuthRateLimitResolutionMiddleware"/>),
+/// falling back to the shipped <see cref="Modgud.Domain.Realms.AuthRateLimitDefaults"/>.
+/// The realm slug AND the resolved limit are baked into the partition key: each realm
+/// gets its own per-IP bucket (so its ceiling is coherent on a shared IdP), and a
+/// config change yields a fresh partition so the new limit applies on the next
+/// request (the stale limiter idles out).
+/// </summary>
+static System.Threading.RateLimiting.RateLimitPartition<string> AuthFixedWindow(
+    HttpContext context, AuthRateLimitPolicy policy, bool isTestEnv)
+{
+    var settings = context.Items.TryGetValue(
+        Modgud.Api.Middleware.AuthRateLimitResolutionMiddleware.ItemsKey, out var raw)
+        ? raw as Modgud.Domain.Realms.AuthRateLimitSettings
+        : null;
+    var rule = Modgud.Domain.Realms.AuthRateLimitSettings.Effective(settings, policy);
+
+    var ipPart = PerIpRateLimitPartitionKey(context, isTestEnv);
+    var realm = context.Items[
+        Modgud.Infrastructure.Persistence.Tenancy.TenantConstants.HttpContextTenantIdKey] as string ?? "-";
+    var key = $"{policy}|{realm}|{ipPart}|{rule.PermitLimit}|{rule.WindowMinutes}";
+
+    return System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
+        partitionKey: key,
+        factory: _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions
+        {
+            PermitLimit = rule.PermitLimit,
+            Window = TimeSpan.FromMinutes(rule.WindowMinutes),
+            QueueLimit = 0,
+        });
+}
diff --git a/src/dotnet/Modgud.Application/DTOs/RealmSettings/AuthRateLimitsDtos.cs b/src/dotnet/Modgud.Application/DTOs/RealmSettings/AuthRateLimitsDtos.cs
new file mode 100644
index 00000000..7c8281ce
--- /dev/null
+++ b/src/dotnet/Modgud.Application/DTOs/RealmSettings/AuthRateLimitsDtos.cs
@@ -0,0 +1,38 @@
+namespace Modgud.Application.DTOs.RealmSettings;
+
+/// <summary>A single rate-limit ceiling on the wire: at most <see cref="PermitLimit"/>
+/// requests per <see cref="WindowMinutes"/> from one source IP (per realm).</summary>
+public record RateLimitRuleDto
+{
+    public int PermitLimit { get; init; }
+    public int WindowMinutes { get; init; }
+}
+
+/// <summary>Read shape for the per-realm auth rate-limit ceilings. Every field is
+/// non-null = the EFFECTIVE rule (the realm override if set, else the shipped
+/// default), so the SPA renders concrete numbers without knowing the defaults.</summary>
+public record AuthRateLimitsDto
+{
+    public RateLimitRuleDto NativeOtp { get; init; } = new();
+    public RateLimitRuleDto MagicLink { get; init; } = new();
+    public RateLimitRuleDto PasswordReset { get; init; } = new();
+    public RateLimitRuleDto EmailOtp { get; init; } = new();
+    public RateLimitRuleDto EmailVerification { get; init; } = new();
+    public RateLimitRuleDto PasskeyBegin { get; init; } = new();
+    public RateLimitRuleDto Bootstrap { get; init; } = new();
+}
+
+/// <summary>Patch payload: a null policy field = no change; a non-null rule
+/// replaces that policy's ceiling (stored as a realm override). Setting a rule
+/// back to the default values simply stores those values — functionally identical
+/// to inheriting, so there is no separate "reset" verb.</summary>
+public record UpdateAuthRateLimitsDto
+{
+    public RateLimitRuleDto? NativeOtp { get; init; }
+    public RateLimitRuleDto? MagicLink { get; init; }
+    public RateLimitRuleDto? PasswordReset { get; init; }
+    public RateLimitRuleDto? EmailOtp { get; init; }
+    public RateLimitRuleDto? EmailVerification { get; init; }
+    public RateLimitRuleDto? PasskeyBegin { get; init; }
+    public RateLimitRuleDto? Bootstrap { get; init; }
+}
diff --git a/src/dotnet/Modgud.Application/DTOs/RealmSettings/RealmSettingsDtos.cs b/src/dotnet/Modgud.Application/DTOs/RealmSettings/RealmSettingsDtos.cs
index cf45e0d6..b6e35270 100644
--- a/src/dotnet/Modgud.Application/DTOs/RealmSettings/RealmSettingsDtos.cs
+++ b/src/dotnet/Modgud.Application/DTOs/RealmSettings/RealmSettingsDtos.cs
@@ -16,6 +16,7 @@ public record RealmSettingsDto
     public DcrSettingsDto Dcr { get; init; } = new();
     public CimdSettingsDto Cimd { get; init; } = new();
     public NativeGrantSettingsDto NativeGrants { get; init; } = new();
+    public AuthRateLimitsDto AuthRateLimits { get; init; } = new();
     public BrandingSettingsDto Branding { get; init; } = new();
     public RegistrationFieldsSettingsDto RegistrationFields { get; init; } = new();
     public DeletionSettingsDto Deletion { get; init; } = new();
@@ -38,6 +39,7 @@ public record UpdateRealmSettingsDto
     public UpdateDcrSettingsDto? Dcr { get; init; }
     public UpdateCimdSettingsDto? Cimd { get; init; }
     public UpdateNativeGrantSettingsDto? NativeGrants { get; init; }
+    public UpdateAuthRateLimitsDto? AuthRateLimits { get; init; }
     public UpdateBrandingSettingsDto? Branding { get; init; }
     public UpdateRegistrationFieldsSettingsDto? RegistrationFields { get; init; }
     public UpdateDeletionSettingsDto? Deletion { get; init; }
diff --git a/src/dotnet/Modgud.Authentication/RealmSettings/RealmSettingsService.cs b/src/dotnet/Modgud.Authentication/RealmSettings/RealmSettingsService.cs
index b1d2040c..b77609b7 100644
--- a/src/dotnet/Modgud.Authentication/RealmSettings/RealmSettingsService.cs
+++ b/src/dotnet/Modgud.Authentication/RealmSettings/RealmSettingsService.cs
@@ -79,6 +79,13 @@ public async Task<ErrorOr<RealmSettingsDto>> PatchAsync(UpdateRealmSettingsDto d
             doc.NativeGrants = native.Value;
         }
 
+        if (dto.AuthRateLimits is not null)
+        {
+            var arl = ApplyAuthRateLimitsPatch(doc.AuthRateLimits, dto.AuthRateLimits);
+            if (arl.IsError) return arl.FirstError;
+            doc.AuthRateLimits = arl.Value;
+        }
+
         if (dto.Branding is not null)
         {
             var branding = ApplyBrandingPatch(doc.Branding, dto.Branding);
@@ -146,6 +153,7 @@ private SelfRegistrationSettings ApplySelfRegistrationPatch(
         Dcr = MapDcrToDto(doc.Dcr),
         Cimd = MapCimdToDto(doc.Cimd),
         NativeGrants = MapNativeGrantsToDto(doc.NativeGrants),
+        AuthRateLimits = MapAuthRateLimitsToDto(doc.AuthRateLimits),
         Branding = MapBrandingToDto(doc.Branding),
         RegistrationFields = MapRegistrationFieldsToDto(doc.RegistrationFields),
         Deletion = MapDeletionToDto(doc.Deletion),
@@ -383,6 +391,74 @@ internal static DcrSettingsDto MapDcrToDto(DcrSettings? s)
         };
     }
 
+    // Per-policy whole-rule replacement: a non-null patch field replaces that
+    // policy's ceiling (stored as a realm override); a null field leaves the
+    // existing override (or the inherited default) untouched.
+    private static ErrorOr<AuthRateLimitSettings> ApplyAuthRateLimitsPatch(
+        AuthRateLimitSettings? current, UpdateAuthRateLimitsDto patch)
+    {
+        var s = current ?? new AuthRateLimitSettings();
+
+        foreach (var (name, rule) in new (string, RateLimitRuleDto?)[]
+                 {
+                     (nameof(patch.NativeOtp), patch.NativeOtp),
+                     (nameof(patch.MagicLink), patch.MagicLink),
+                     (nameof(patch.PasswordReset), patch.PasswordReset),
+                     (nameof(patch.EmailOtp), patch.EmailOtp),
+                     (nameof(patch.EmailVerification), patch.EmailVerification),
+                     (nameof(patch.PasskeyBegin), patch.PasskeyBegin),
+                     (nameof(patch.Bootstrap), patch.Bootstrap),
+                 })
+        {
+            if (rule is not null && ValidateRateLimitRule(name, rule) is { } err) return err;
+        }
+
+        return s with
+        {
+            NativeOtp = patch.NativeOtp is { } a ? ToRule(a) : s.NativeOtp,
+            MagicLink = patch.MagicLink is { } b ? ToRule(b) : s.MagicLink,
+            PasswordReset = patch.PasswordReset is { } c ? ToRule(c) : s.PasswordReset,
+            EmailOtp = patch.EmailOtp is { } d ? ToRule(d) : s.EmailOtp,
+            EmailVerification = patch.EmailVerification is { } e ? ToRule(e) : s.EmailVerification,
+            PasskeyBegin = patch.PasskeyBegin is { } f ? ToRule(f) : s.PasskeyBegin,
+            Bootstrap = patch.Bootstrap is { } g ? ToRule(g) : s.Bootstrap,
+        };
+
+        static RateLimitRule ToRule(RateLimitRuleDto d)
+            => new() { PermitLimit = d.PermitLimit, WindowMinutes = d.WindowMinutes };
+    }
+
+    private static Error? ValidateRateLimitRule(string policy, RateLimitRuleDto rule)
+    {
+        if (rule.PermitLimit is < 1 or > 100_000)
+            return Error.Validation($"AuthRateLimits.{policy}.PermitLimit",
+                "PermitLimit must be between 1 and 100000.");
+        if (rule.WindowMinutes is < 1 or > 1440)
+            return Error.Validation($"AuthRateLimits.{policy}.WindowMinutes",
+                "WindowMinutes must be between 1 and 1440 (24 hours).");
+        return null;
+    }
+
+    internal static AuthRateLimitsDto MapAuthRateLimitsToDto(AuthRateLimitSettings? s)
+    {
+        static RateLimitRuleDto Eff(AuthRateLimitSettings? settings, AuthRateLimitPolicy p)
+        {
+            var r = AuthRateLimitSettings.Effective(settings, p);
+            return new RateLimitRuleDto { PermitLimit = r.PermitLimit, WindowMinutes = r.WindowMinutes };
+        }
+
+        return new AuthRateLimitsDto
+        {
+            NativeOtp = Eff(s, AuthRateLimitPolicy.NativeOtp),
+            MagicLink = Eff(s, AuthRateLimitPolicy.MagicLink),
+            PasswordReset = Eff(s, AuthRateLimitPolicy.PasswordReset),
+            EmailOtp = Eff(s, AuthRateLimitPolicy.EmailOtp),
+            EmailVerification = Eff(s, AuthRateLimitPolicy.EmailVerification),
+            PasskeyBegin = Eff(s, AuthRateLimitPolicy.PasskeyBegin),
+            Bootstrap = Eff(s, AuthRateLimitPolicy.Bootstrap),
+        };
+    }
+
     private static ErrorOr<CimdSettings> ApplyCimdPatch(CimdSettings? current, UpdateCimdSettingsDto patch)
     {
         var s = current ?? new CimdSettings();
diff --git a/src/dotnet/Modgud.Domain/RealmSettings/RealmSettings.cs b/src/dotnet/Modgud.Domain/RealmSettings/RealmSettings.cs
index 800c848a..d78aa106 100644
--- a/src/dotnet/Modgud.Domain/RealmSettings/RealmSettings.cs
+++ b/src/dotnet/Modgud.Domain/RealmSettings/RealmSettings.cs
@@ -59,6 +59,13 @@ public class RealmSettings
     /// additional, separate gate.</summary>
     public NativeGrantSettings? NativeGrants { get; set; }
 
+    /// <summary>Per-realm overrides for the per-IP auth rate-limit ceilings
+    /// (native-otp, magic-link, password-reset, email-otp, email-verification,
+    /// passkey-begin, bootstrap). Null = never configured; every policy uses its
+    /// shipped <see cref="AuthRateLimitDefaults"/>. A null rule for an individual
+    /// policy likewise falls back to that policy's default.</summary>
+    public AuthRateLimitSettings? AuthRateLimits { get; set; }
+
     /// <summary>Per-realm SPA branding (product name, logo, primary color,
     /// favicon). Null = SPA falls back to the Cocoar default. Surfaced via
     /// the anonymous <c>/api/app-info</c> so the login page renders branded
diff --git a/src/dotnet/Modgud.Domain/Realms/AuthRateLimitSettings.cs b/src/dotnet/Modgud.Domain/Realms/AuthRateLimitSettings.cs
new file mode 100644
index 00000000..525c7e71
--- /dev/null
+++ b/src/dotnet/Modgud.Domain/Realms/AuthRateLimitSettings.cs
@@ -0,0 +1,114 @@
+namespace Modgud.Domain.Realms;
+
+/// <summary>
+/// The set of per-IP auth rate-limit policies whose ceiling a realm admin can
+/// raise/lower. These mirror the hardcoded ASP.NET limiter policies of the same
+/// name registered in <c>Program.cs</c>; <see cref="AuthRateLimitSettings"/> lets
+/// a realm override the limit/window per policy, with the code defaults
+/// (<see cref="AuthRateLimitDefaults"/>) as the baseline.
+/// </summary>
+public enum AuthRateLimitPolicy
+{
+    /// <summary>Native passwordless OTP request + native register (5/h).</summary>
+    NativeOtp,
+    /// <summary>Magic-link request (5/h).</summary>
+    MagicLink,
+    /// <summary>Forgot-password / password-reset request (5/h).</summary>
+    PasswordReset,
+    /// <summary>Email-OTP login (30/min).</summary>
+    EmailOtp,
+    /// <summary>Email verification resend (5/h).</summary>
+    EmailVerification,
+    /// <summary>Native passkey begin / enroll-begin / enroll (60/5min).</summary>
+    PasskeyBegin,
+    /// <summary>First-admin bootstrap (10/15min).</summary>
+    Bootstrap,
+}
+
+/// <summary>
+/// A single rate-limit ceiling: at most <see cref="PermitLimit"/> requests per
+/// <see cref="WindowMinutes"/> from one partition (per-IP, per-realm). Whole
+/// minutes are enough for every auth policy (the tightest is 1 minute).
+/// </summary>
+public record RateLimitRule
+{
+    public int PermitLimit { get; init; }
+    public int WindowMinutes { get; init; }
+}
+
+/// <summary>
+/// The shipped defaults for each <see cref="AuthRateLimitPolicy"/> — kept in code
+/// so a realm that never touches the feature behaves exactly as before. They are
+/// the single source of truth for both the live limiter (fallback when a realm has
+/// no override) and the admin UI (shown as placeholders / reset target).
+/// </summary>
+public static class AuthRateLimitDefaults
+{
+    public static RateLimitRule For(AuthRateLimitPolicy policy) => policy switch
+    {
+        AuthRateLimitPolicy.NativeOtp => new RateLimitRule { PermitLimit = 5, WindowMinutes = 60 },
+        AuthRateLimitPolicy.MagicLink => new RateLimitRule { PermitLimit = 5, WindowMinutes = 60 },
+        AuthRateLimitPolicy.PasswordReset => new RateLimitRule { PermitLimit = 5, WindowMinutes = 60 },
+        AuthRateLimitPolicy.EmailOtp => new RateLimitRule { PermitLimit = 30, WindowMinutes = 1 },
+        AuthRateLimitPolicy.EmailVerification => new RateLimitRule { PermitLimit = 5, WindowMinutes = 60 },
+        AuthRateLimitPolicy.PasskeyBegin => new RateLimitRule { PermitLimit = 60, WindowMinutes = 5 },
+        AuthRateLimitPolicy.Bootstrap => new RateLimitRule { PermitLimit = 10, WindowMinutes = 15 },
+        _ => new RateLimitRule { PermitLimit = 5, WindowMinutes = 60 },
+    };
+
+    /// <summary>The ASP.NET limiter policy name (matches <c>RequireRateLimiting</c>
+    /// call sites and <c>AddPolicy</c> registrations in <c>Program.cs</c>).</summary>
+    public static string PolicyName(AuthRateLimitPolicy policy) => policy switch
+    {
+        AuthRateLimitPolicy.NativeOtp => "native-otp",
+        AuthRateLimitPolicy.MagicLink => "magic-link",
+        AuthRateLimitPolicy.PasswordReset => "password-reset",
+        AuthRateLimitPolicy.EmailOtp => "email-otp",
+        AuthRateLimitPolicy.EmailVerification => "email-verification",
+        AuthRateLimitPolicy.PasskeyBegin => "passkey-begin",
+        AuthRateLimitPolicy.Bootstrap => "bootstrap",
+        _ => "native-otp",
+    };
+}
+
+/// <summary>
+/// Per-realm overrides for the per-IP auth rate-limit ceilings. Lives as a
+/// nullable sub-document on the tenant-DB <see cref="RealmSettings.RealmSettings"/>
+/// aggregate (null = the realm has never touched the feature → every policy uses
+/// its <see cref="AuthRateLimitDefaults"/>). A null rule for an individual policy
+/// likewise falls back to that policy's default, so the doc only ever stores the
+/// limits an admin actually changed.
+///
+/// <para>Owned by the realm-admin (not Control-Plane). The default values keep the
+/// secure production posture; the knob exists so test realms, dev, or legitimately
+/// bursty consumers can raise a ceiling without a modgud code change + redeploy.</para>
+/// </summary>
+public record AuthRateLimitSettings
+{
+    public RateLimitRule? NativeOtp { get; init; }
+    public RateLimitRule? MagicLink { get; init; }
+    public RateLimitRule? PasswordReset { get; init; }
+    public RateLimitRule? EmailOtp { get; init; }
+    public RateLimitRule? EmailVerification { get; init; }
+    public RateLimitRule? PasskeyBegin { get; init; }
+    public RateLimitRule? Bootstrap { get; init; }
+
+    /// <summary>The configured override for a policy, or null if it inherits the default.</summary>
+    public RateLimitRule? Get(AuthRateLimitPolicy policy) => policy switch
+    {
+        AuthRateLimitPolicy.NativeOtp => NativeOtp,
+        AuthRateLimitPolicy.MagicLink => MagicLink,
+        AuthRateLimitPolicy.PasswordReset => PasswordReset,
+        AuthRateLimitPolicy.EmailOtp => EmailOtp,
+        AuthRateLimitPolicy.EmailVerification => EmailVerification,
+        AuthRateLimitPolicy.PasskeyBegin => PasskeyBegin,
+        AuthRateLimitPolicy.Bootstrap => Bootstrap,
+        _ => null,
+    };
+
+    /// <summary>The effective rule for a policy: the realm override if set, else
+    /// the shipped default. Static so the live limiter can resolve from a possibly
+    /// null settings section in one call.</summary>
+    public static RateLimitRule Effective(AuthRateLimitSettings? settings, AuthRateLimitPolicy policy)
+        => settings?.Get(policy) ?? AuthRateLimitDefaults.For(policy);
+}
diff --git a/src/frontend-vue/public/i18n/de.json b/src/frontend-vue/public/i18n/de.json
index 3f9dce8b..dae9d141 100644
--- a/src/frontend-vue/public/i18n/de.json
+++ b/src/frontend-vue/public/i18n/de.json
@@ -1361,6 +1361,7 @@
         "dcr": "Dynamic Client Registration",
         "cimd": "Client-ID-Metadaten (CIMD)",
         "nativeGrants": "Native passwortlose Grants",
+        "authRateLimits": "Rate-Limits",
         "branding": "Branding",
         "deletion": "Konto-Löschung",
         "signingKeys": "Signing-Schlüssel",
@@ -1441,6 +1442,18 @@
         "refreshTokenDays": "Refresh-Token-Lebensdauer (Tage)",
         "optInWarning": "Pro-Client-Opt-in weiterhin nötig: Ein Client kann einen nativen Grant erst nutzen, wenn er die passende Grant-Type-Permission trägt (gt:urn:cocoar:otp / :magic / :passkey), aktiviert im Grants-Tab des Clients. Dieser Realm-Schalter ist notwendig, aber nicht hinreichend. Nur Katalog-Clients kommen infrage — DCR-/CIMD-Clients sind ausgeschlossen."
       },
+      "authRateLimits": {
+        "hint": "Pro-IP-Anfrage-Obergrenzen für die Auth-Endpoints dieses Realms: höchstens „Max. Anfragen“ pro „Fenster“ (Minuten) von einer Quell-IP. Die Defaults sind die sichere Produktions-Vorgabe — erhöhe sie nur für Test-Realms, Dev oder legitim stoßweise Consumer; senke sie zum Verschärfen. Jeder Wert gilt pro Realm.",
+        "permitLimit": "Max. Anfragen",
+        "windowMinutes": "Fenster (Minuten)",
+        "nativeOtp": "Native-OTP-Anfrage (passwortloser Login-Code)",
+        "magicLink": "Magic-Link-Anfrage",
+        "passwordReset": "Passwort-Reset-Anfrage",
+        "emailOtp": "E-Mail-OTP-Login-Prüfung",
+        "emailVerification": "E-Mail-Verifizierung erneut senden",
+        "passkeyBegin": "Passkey-Ceremony Begin / Enroll",
+        "bootstrap": "First-Admin-Bootstrap"
+      },
       "regFields": {
         "hint": "Welche Identitätsfelder bei der Kontoerstellung gefordert sind (Admin-Anlage, Selbstregistrierung, native passwortlose Registrierung). E-Mail ist immer Pflicht. Pro Application überschreibbar."
       }
diff --git a/src/frontend-vue/src/models/realmSettings.ts b/src/frontend-vue/src/models/realmSettings.ts
index c76d01e6..fe8bf1da 100644
--- a/src/frontend-vue/src/models/realmSettings.ts
+++ b/src/frontend-vue/src/models/realmSettings.ts
@@ -8,6 +8,7 @@ export interface RealmSettingsDto {
   Dcr: DcrSettingsDto
   Cimd: CimdSettingsDto
   NativeGrants: NativeGrantSettingsDto
+  AuthRateLimits: AuthRateLimitsDto
   Branding: BrandingSettingsDto
   RegistrationFields: RegistrationFieldsSettingsDto
   Deletion: DeletionSettingsDto
@@ -21,6 +22,7 @@ export interface UpdateRealmSettingsDto {
   Dcr?: UpdateDcrSettingsDto | null
   Cimd?: UpdateCimdSettingsDto | null
   NativeGrants?: UpdateNativeGrantSettingsDto | null
+  AuthRateLimits?: UpdateAuthRateLimitsDto | null
   Branding?: UpdateBrandingSettingsDto | null
   RegistrationFields?: UpdateRegistrationFieldsSettingsDto | null
   Deletion?: UpdateDeletionSettingsDto | null
@@ -176,3 +178,35 @@ export interface UpdateNativeGrantSettingsDto {
   AccessTokenLifetimeMinutes?: number
   RefreshTokenLifetimeDays?: number
 }
+
+// Per-IP auth rate-limit ceilings, configurable per realm. Each policy is a
+// { PermitLimit, WindowMinutes } pair; the read shape carries the EFFECTIVE
+// values (the realm override if set, else the shipped default), so the form
+// shows concrete numbers. Lowering tightens, raising relaxes — defaults keep
+// the secure production posture. Mirrors AuthRateLimitsDtos.cs.
+export interface RateLimitRuleDto {
+  PermitLimit: number
+  WindowMinutes: number
+}
+
+export interface AuthRateLimitsDto {
+  NativeOtp: RateLimitRuleDto
+  MagicLink: RateLimitRuleDto
+  PasswordReset: RateLimitRuleDto
+  EmailOtp: RateLimitRuleDto
+  EmailVerification: RateLimitRuleDto
+  PasskeyBegin: RateLimitRuleDto
+  Bootstrap: RateLimitRuleDto
+}
+
+// PATCH shape: a missing policy = no change; a present rule replaces that
+// policy's ceiling (stored as a realm override).
+export interface UpdateAuthRateLimitsDto {
+  NativeOtp?: RateLimitRuleDto
+  MagicLink?: RateLimitRuleDto
+  PasswordReset?: RateLimitRuleDto
+  EmailOtp?: RateLimitRuleDto
+  EmailVerification?: RateLimitRuleDto
+  PasskeyBegin?: RateLimitRuleDto
+  Bootstrap?: RateLimitRuleDto
+}
diff --git a/src/frontend-vue/src/views/admin/RealmSettingsView.vue b/src/frontend-vue/src/views/admin/RealmSettingsView.vue
index 84e63c5b..a99f9f68 100644
--- a/src/frontend-vue/src/views/admin/RealmSettingsView.vue
+++ b/src/frontend-vue/src/views/admin/RealmSettingsView.vue
@@ -29,6 +29,8 @@ import type {
   UpdateCimdSettingsDto,
   NativeGrantSettingsDto,
   UpdateNativeGrantSettingsDto,
+  AuthRateLimitsDto,
+  UpdateAuthRateLimitsDto,
   DeletionSettingsDto,
   UpdateDeletionSettingsDto,
   RegistrationFieldsSettingsDto,
@@ -51,7 +53,7 @@ watch(language, () => ui.set((ctx) => {
   ctx.content.hasSubNav = true
 }), { immediate: true })
 
-type TabId = 'self-registration' | 'registration-fields' | 'dcr' | 'cimd' | 'native-grants' | 'deletion' | 'signing-keys'
+type TabId = 'self-registration' | 'registration-fields' | 'dcr' | 'cimd' | 'native-grants' | 'auth-rate-limits' | 'deletion' | 'signing-keys'
 const activeTab = ref<TabId>('self-registration')
 
 const canRotateSigningKey = computed(() => authStore.hasPermission('realm-settings:write'))
@@ -159,6 +161,54 @@ function nativeGrantsFromDto(d: NativeGrantSettingsDto): NativeGrantFormState {
   }
 }
 
+// ── Auth rate-limit form state (per-IP ceilings, configurable per realm) ──
+type RateLimitPolicyKey =
+  'NativeOtp' | 'MagicLink' | 'PasswordReset' | 'EmailOtp'
+  | 'EmailVerification' | 'PasskeyBegin' | 'Bootstrap'
+
+type AuthRateLimitsFormState = Record<RateLimitPolicyKey, { PermitLimit: number; WindowMinutes: number }>
+
+// Display order + labels for the rate-limit grid. Labels carry the endpoint so an
+// admin knows which flow each ceiling gates.
+const rateLimitPolicies: { key: RateLimitPolicyKey; labelKey: string; fallback: string }[] = [
+  { key: 'NativeOtp', labelKey: 'admin.realmSettings.authRateLimits.nativeOtp', fallback: 'Native OTP request (passwordless login code)' },
+  { key: 'MagicLink', labelKey: 'admin.realmSettings.authRateLimits.magicLink', fallback: 'Magic-link request' },
+  { key: 'PasswordReset', labelKey: 'admin.realmSettings.authRateLimits.passwordReset', fallback: 'Password-reset request' },
+  { key: 'EmailOtp', labelKey: 'admin.realmSettings.authRateLimits.emailOtp', fallback: 'Email-OTP login verify' },
+  { key: 'EmailVerification', labelKey: 'admin.realmSettings.authRateLimits.emailVerification', fallback: 'Email verification resend' },
+  { key: 'PasskeyBegin', labelKey: 'admin.realmSettings.authRateLimits.passkeyBegin', fallback: 'Passkey ceremony begin / enroll' },
+  { key: 'Bootstrap', labelKey: 'admin.realmSettings.authRateLimits.bootstrap', fallback: 'First-admin bootstrap' },
+]
+
+function emptyAuthRateLimits(): AuthRateLimitsFormState {
+  return {
+    NativeOtp: { PermitLimit: 5, WindowMinutes: 60 },
+    MagicLink: { PermitLimit: 5, WindowMinutes: 60 },
+    PasswordReset: { PermitLimit: 5, WindowMinutes: 60 },
+    EmailOtp: { PermitLimit: 30, WindowMinutes: 1 },
+    EmailVerification: { PermitLimit: 5, WindowMinutes: 60 },
+    PasskeyBegin: { PermitLimit: 60, WindowMinutes: 5 },
+    Bootstrap: { PermitLimit: 10, WindowMinutes: 15 },
+  }
+}
+
+const authRateLimitsForm = ref<AuthRateLimitsFormState>(emptyAuthRateLimits())
+const originalAuthRateLimits = ref<AuthRateLimitsDto | null>(null)
+
+function authRateLimitsFromDto(d: AuthRateLimitsDto): AuthRateLimitsFormState {
+  const copy = (r: { PermitLimit: number; WindowMinutes: number }) =>
+    ({ PermitLimit: r.PermitLimit, WindowMinutes: r.WindowMinutes })
+  return {
+    NativeOtp: copy(d.NativeOtp),
+    MagicLink: copy(d.MagicLink),
+    PasswordReset: copy(d.PasswordReset),
+    EmailOtp: copy(d.EmailOtp),
+    EmailVerification: copy(d.EmailVerification),
+    PasskeyBegin: copy(d.PasskeyBegin),
+    Bootstrap: copy(d.Bootstrap),
+  }
+}
+
 // ── Deletion-policy form state ───────────────────────────────────────
 interface DeletionFormState {
   GraceDays: number
@@ -251,6 +301,8 @@ onMounted(async () => {
     cimdForm.value = cimdFromDto(dto.Cimd)
     originalNativeGrants.value = dto.NativeGrants
     nativeGrantsForm.value = nativeGrantsFromDto(dto.NativeGrants)
+    originalAuthRateLimits.value = dto.AuthRateLimits
+    authRateLimitsForm.value = authRateLimitsFromDto(dto.AuthRateLimits)
     originalDeletion.value = dto.Deletion
     deletionForm.value = deletionFromDto(dto.Deletion)
     originalRegFields.value = dto.RegistrationFields
@@ -351,6 +403,22 @@ function buildNativeGrantsPatch(): UpdateNativeGrantSettingsDto | undefined {
   return Object.keys(patch).length === 0 ? undefined : patch
 }
 
+function buildAuthRateLimitsPatch(): UpdateAuthRateLimitsDto | undefined {
+  const orig = originalAuthRateLimits.value
+  if (!orig) return undefined
+  const cur = authRateLimitsForm.value
+  const patch: UpdateAuthRateLimitsDto = {}
+
+  for (const { key } of rateLimitPolicies) {
+    const o = orig[key]
+    const c = cur[key]
+    if (c.PermitLimit !== o.PermitLimit || c.WindowMinutes !== o.WindowMinutes)
+      patch[key] = { PermitLimit: c.PermitLimit, WindowMinutes: c.WindowMinutes }
+  }
+
+  return Object.keys(patch).length === 0 ? undefined : patch
+}
+
 function buildDeletionPatch(): UpdateDeletionSettingsDto | undefined {
   const orig = originalDeletion.value
   if (!orig) return undefined
@@ -383,9 +451,10 @@ async function save() {
   const dcrPatch = buildDcrPatch()
   const cimdPatch = buildCimdPatch()
   const nativeGrantsPatch = buildNativeGrantsPatch()
+  const authRateLimitsPatch = buildAuthRateLimitsPatch()
   const deletionPatch = buildDeletionPatch()
   const regFieldsPatch = buildRegFieldsPatch()
-  if (!selfRegPatch && !dcrPatch && !cimdPatch && !nativeGrantsPatch && !deletionPatch && !regFieldsPatch) {
+  if (!selfRegPatch && !dcrPatch && !cimdPatch && !nativeGrantsPatch && !authRateLimitsPatch && !deletionPatch && !regFieldsPatch) {
     savedFlash.value = true
     setTimeout(() => { savedFlash.value = false }, 1200)
     return
@@ -398,6 +467,7 @@ async function save() {
       Dcr?: UpdateDcrSettingsDto
       Cimd?: UpdateCimdSettingsDto
       NativeGrants?: UpdateNativeGrantSettingsDto
+      AuthRateLimits?: UpdateAuthRateLimitsDto
       Deletion?: UpdateDeletionSettingsDto
       RegistrationFields?: UpdateRegistrationFieldsSettingsDto
     } = {}
@@ -405,6 +475,7 @@ async function save() {
     if (dcrPatch) payload.Dcr = dcrPatch
     if (cimdPatch) payload.Cimd = cimdPatch
     if (nativeGrantsPatch) payload.NativeGrants = nativeGrantsPatch
+    if (authRateLimitsPatch) payload.AuthRateLimits = authRateLimitsPatch
     if (deletionPatch) payload.Deletion = deletionPatch
     if (regFieldsPatch) payload.RegistrationFields = regFieldsPatch
     const updated = await settingsStore.patch(payload)
@@ -416,6 +487,8 @@ async function save() {
     cimdForm.value = cimdFromDto(updated.Cimd)
     originalNativeGrants.value = updated.NativeGrants
     nativeGrantsForm.value = nativeGrantsFromDto(updated.NativeGrants)
+    originalAuthRateLimits.value = updated.AuthRateLimits
+    authRateLimitsForm.value = authRateLimitsFromDto(updated.AuthRateLimits)
     originalDeletion.value = updated.Deletion
     deletionForm.value = deletionFromDto(updated.Deletion)
     originalRegFields.value = updated.RegistrationFields
@@ -466,6 +539,9 @@ async function rotateSigningKey() {
       <CoarTab id="native-grants">
         {{ t('admin.realmSettings.tabs.nativeGrants', {}, 'Native Passwordless Grants') }}
       </CoarTab>
+      <CoarTab id="auth-rate-limits">
+        {{ t('admin.realmSettings.tabs.authRateLimits', {}, 'Rate Limits') }}
+      </CoarTab>
       <CoarTab id="deletion">
         {{ t('admin.realmSettings.tabs.deletion', {}, 'Account Deletion') }}
       </CoarTab>
@@ -753,6 +829,39 @@ async function rotateSigningKey() {
       </div>
     </CoarCard>
 
+    <CoarCard v-else-if="activeTab === 'auth-rate-limits'" class="p-4">
+      <div class="flex flex-col gap-3">
+        <p class="text-xs text-gray-500">
+          {{ t('admin.realmSettings.authRateLimits.hint', {}, 'Per-IP request ceilings for this realm’s auth endpoints: at most PermitLimit requests per Window (minutes) from one source IP. The defaults are the secure production posture — raise them only for test realms, dev, or legitimately bursty consumers; lower them to tighten. Each value applies per realm.') }}
+        </p>
+
+        <div
+          v-for="p in rateLimitPolicies"
+          :key="p.key"
+          class="grid grid-cols-[1fr_auto_auto] items-end gap-3">
+          <div class="text-sm self-center">{{ t(p.labelKey, {}, p.fallback) }}</div>
+          <CoarFormField :label="t('admin.realmSettings.authRateLimits.permitLimit', {}, 'Max requests')">
+            <CoarTextInput
+              class="w-28"
+              :model-value="String(authRateLimitsForm[p.key].PermitLimit)"
+              @update:model-value="(v) => (authRateLimitsForm[p.key].PermitLimit = Math.max(1, parseInt(v) || 1))" />
+          </CoarFormField>
+          <CoarFormField :label="t('admin.realmSettings.authRateLimits.windowMinutes', {}, 'Window (minutes)')">
+            <CoarTextInput
+              class="w-28"
+              :model-value="String(authRateLimitsForm[p.key].WindowMinutes)"
+              @update:model-value="(v) => (authRateLimitsForm[p.key].WindowMinutes = Math.max(1, parseInt(v) || 1))" />
+          </CoarFormField>
+        </div>
+
+        <div class="flex justify-end mt-2">
+          <CoarButton :loading="saving" @click="save">
+            {{ t('common.save', {}, 'Save') }}
+          </CoarButton>
+        </div>
+      </div>
+    </CoarCard>
+
     <CoarCard v-else-if="activeTab === 'deletion'" class="p-4">
       <div class="flex flex-col gap-3">
         <p class="text-xs text-gray-500">