RustyAuthGitHubStarsGet started →

Reproducible performance evidence

One realm.
2,400 mixed RPS.

173 ms p95 through Railway’s public edge,
with zero unplanned server 5xx at the retained boundary.

Explore the evidence →Download data ↓

Measured boundary curve · lower is better

The mixed journey clears 2,400 RPS and bends at 3,200 RPS

Exact two-minute public Railway windows. Lines are separate timing lenses and are not additive.

Capacity spectrum single realm

Supported planning560 RPS

5,600 typical active users

Published production planning
Retained candidate signal1,680 RPS

16,800 typical active users

Observed short-window headroom rate
First tested bend3,200 RPS

296 ms end-to-end p95

Not a planning target

Supported is what we plan for. Candidate is what the retained boundary suggests. Bend is where the strict gates first stop passing.

Size your realm

Planning model for simultaneously active users—not stored accounts or MAU.

Assumption Six authenticated requests per active user per minute

Choose active audience

Simultaneously active10,000users

Request demand1,000RPS at six requests/minute

Supported planning2independent realm cells

Candidate model1realm cell · not Fleet proof

Stored-account limits, redundancy, Fleet coordination, global routing and regional recovery require separate qualification.

Retained run · 288,140 measured requests

The proof

Public-edge Railway. Mixed workload. Zero unplanned 5xx at the 2,400 RPS boundary.

Latency lenses p95 · not additive

End-to-endPublic Railway edge
173 ms
ApplicationIncludes datastore work
142 ms
SableDBAccumulated datastore time
142 ms
External pathRunner, edge and network
55 ms

Boundary result 2,400 RPS

End-to-end p95
173 ms
Unexpected failure rate
0.033%
Unplanned 5xx
0
Passkey ceremony p95 under load
221 ms

Workload mix High-traffic product journey v2

  • Session-backed account read60%
  • User token mint20%
  • Passkey inventory read15%
  • Public signing-key discovery5%
MethodologyDataset, hardware, workload, soak window and boundaries+

Environment: Railway: API 1 vCPU / 1 GB; SableDB 4 vCPU / 4 GB; public Railway edge.

Dataset: 10,000 synthetic accounts and 10,000 valid sessions.

Qualification: Retained two-minute boundary, first-failure and passkey evidence; one-hour soak stopped at 37m40.7s. The candidate rate is not promoted until a fresh one-hour soak and recovery pass.

Raw evidenceReports, reviewed metrics, traces and deployment artefacts+
Informational enterprise report↗Railway wind-down record↗Reviewed metrics and deployment artifacts↗Raw final-run artifacts↗Captured Railway metrics↗Machine-readable benchmark catalogue↓
Cost & operationsMeasured shape, incomplete soak and what is not included+

RustyAuth API1 vCPU / 1 GB ceiling

SableDB4 vCPU / 4 GB ceiling

Monthly run-rateNot claimed from the incomplete soak

AdditionalStorage, egress, redundancy and operator time

Publication gatesWhat must pass before a result becomes supported capacity+
  1. Unexpected request failures below 0.1% and no unplanned 5xx responses
  2. Mixed end-to-end latency below 300 ms p95 and 750 ms p99
  3. Application latency below 150 ms p95 / 400 ms p99 and accumulated SableDB below 150 ms p95 / 250 ms p99
  4. The measured phase completes its exact scheduled arrival count; excluded warm-up drops remain disclosed
  5. Complete passkey ceremonies remain below 750 ms p95 and 1,500 ms p99 under operating load
  6. A one-hour operating-rate soak completes without readiness loss, restart or out-of-memory event
  7. Published user capacity retains 30% measured throughput headroom
Competitor contextFirst-party public signals, with unlike workloads labelled−
ProviderPublic signalReference shapeHow to read it
RustyAuth 1.0Public signal2,400 mixed RPS at 173 ms p95Reference shapeRailway: API 1 vCPU / 1 GB; SableDB 4 vCPU / 4 GB; public Railway edgeHow to read itMeasured here. Candidate operating capacity still needs a fresh one-hour soak and recovery. ↗KeycloakPublic signalRegularly tested at 300 RPS / 1,000,000 usersReference shapeThree pods plus a multi-AZ Aurora reference architectureHow to read itStronger large-dataset and HA evidence; a different workload and much larger topology. ↗RauthyPublic signal35–65 MB published small-deployment footprintReference shapeEmbedded Hiqlite or PostgreSQLHow to read itPromising footprint, but no reproducible like-for-like public RPS run. ↗ClerkPublic signalProduction Backend API limit: 1,000 requests / 10 secondsReference shapeManaged multi-tenant serviceHow to read itA service limit, not a benchmark; browser auth and local token checks differ. ↗Auth0Public signalPrivate Cloud tiers: 100–10,000 RPSReference shapeManaged public or dedicated private cloudHow to read itA contracted rate envelope without a matching public workload or latency trace. ↗
See the evidence →Download JSON ↓

Published 11 August 2026Active baseline: Single-realm Railway