Question - How many request needed to trigger 'TooManyRequestsException'?

Thanks for your reply to my other issue. This is a follow up question.

How many is too many?
In practice, I've never hit it. I've shot 300 login requests at it using BurpSuite Professional's Intruder tool with an invalid password, followed by a valid password. The final request was successful, and the user was logged in. That's an "account lockout" security finding everywhere I've worked.

I'd like to better understand how this is expected to work, so that I can perform a test against it to ensure it is working like that - then modify my implementation to throw this request more easily on a login.

Currently, I just went to cloudflare WAF and set a rate limit on the endpoints I use for the auth object.

The issue does not name any files, tests, or entry points. Start by locating the authentication request handling and the TooManyRequestsException behavior, then clarify the expected request threshold and whether the rate limit belongs in PHP-Auth or the Cloudflare WAF configuration. Done means the expected behavior is documented or tested and the implementation's scope is agreed.

Written by the indexing model from the issue text.