Fluent Commerce Logo
Docs

Platform

APIs (GraphQL, Core, Authentication, Event, and Batch), Legal Resources, SLAs, Platform Limits, Cloud Architecture, Environments, Entities, Objects, and Attributes.

User Lockouts: What to Expect After Too Many Failed Login Attempts

Essential knowledge
This article explains what happens when an account is temporarily locked due to multiple failed login attempts, whether caused by a user entering the wrong password or an integration using outdated credentials.After reading this article, you will understand:
  • What triggers a username lockout in Fluent 
  • How the lockout works 
  • What actions users and integration owners should take
Key Points to Know:
  • Lockouts are temporary (15 minutes).
  • Applies to both web console users and API clients.
  • A lockout is enforced even if the correct password is entered after the threshold is reached.
  • Accounts are locked after multiple failed login attempts ( 5 attempts).
  • Lockouts are specific to the username with failed login attempts
  • The lockout period is 15 minutes, starting from the last failed attempt.
  • Lockouts apply across all login methods (web, API, scripts) using the same username.
  • During a lockout for a given username:
    • All logins (even with correct credentials) will return an error
    • The error message will be exactly the same as providing an incorrect username and password (even with correct credentials)
  • The login screen and error messages will clearly reflect lockout status.
  • Technical users maintaining integration code should ensure their code does not retry authentication more than 5 times. 
  • Avoid account sharing between UI users and integrations to prevent cross-impact.
  • Contact Support if you're locked out and need urgent access.