---
url: "https://vueda.dev/v3/reference/api/py/vueda.user.throttles.md"
title: "user.throttles"
---

# user.throttles

## Overview

Rate limits for VUEDA's auth endpoints.

## Classes

- [ClientIPScopedRateThrottle](/v3/reference/api/py/vueda.user.throttles/ClientIPScopedRateThrottle.md)

## `throttle_code_send` {#throttle_code_send}

Count one code sent to ``user`` by ``method``. Raise ``Throttled`` when a rate that applies is used up.

The ``totp_send_user`` rate counts the codes sent for one account by one method, email or sms. Each
method has its own count, so a user who uses up their SMS codes can still get one by email.

Pass ``destination`` when the caller chose it, as when setting up a device. The
``totp_send_destination`` rate then also counts the codes sent to that email address or phone number
across all accounts, so one address cannot be flooded from many accounts. A registered device's
destination is left out, because its own user's rate covers it. Counting it across accounts would let
anyone use up another user's sign-in codes by sending setup codes to their address.

A refused send counts toward no rate. ``Throttled`` makes DRF answer 429 with a ``Retry-After``
header. Call this right before sending, after every other check has passed.

### Signature {#throttle_code_send-signature}

`throttle_code_send(request, user, method, destination)`

#### Parameters {#throttle_code_send-parameters}

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| <span id="throttle_code_send-param-request">request</span> |  | yes |  |  |
| <span id="throttle_code_send-param-user">user</span> |  | yes |  |  |
| <span id="throttle_code_send-param-method">method</span> |  | yes |  |  |
| <span id="throttle_code_send-param-destination">destination</span> |  | no | `None` |  |

### Source {#throttle_code_send-source}

`server/vueda/user/throttles.py:69`

## Source

`server/vueda/user/throttles.py`