diff --git a/server/src/index.js b/server/src/index.js
index 0c4c50a..3a20067 100644
--- a/server/src/index.js
+++ b/server/src/index.js
@@ -106,6 +106,8 @@ async function build() {
   });
 
   const authHook = makeAuthHook(config);
+  const authRateLimitHook = app.rateLimit({ max: 200, timeWindow: '1 minute' });
+  app.addHook('preHandler', authRateLimitHook);
   app.addHook('preHandler', authHook);
 
   app.register(require('./routes/health'));