Limits against abuse: codes per number per hour and the wait between resends

The short answer: your account has two rules for verification codes, and by default both are off (value 0): resend_wait_seconds, the wait between resends of the same code (up to 3,600 seconds, one hour), and max_codes_per_number_per_hour, the maximum number of codes, new and resent, each number can receive in an hour (up to 1,000). Turn them on before opening your form to the public.

The two rules

Rule	What it stops	Values
resend_wait_seconds	Repeated resends of the same code: the “Resend” button pressed over and over	0 (no limit, the default) to 3,600 seconds
max_codes_per_number_per_hour	Many codes to the same number: new and resent both count	0 (no limit, the default) to 1,000 per hour

The rules apply to the whole account, to every key and every app. You do not send them with each code.

Where to change them

1	In My MozOut, on the API keys page: the same rules, without writing code.

2	Through the API, with GET /v1/sms/otp-settings to read them (sms:read permission) and PUT /v1/sms/otp-settings to change them (sms:write permission). Send only what you want to change; 0 removes the limit.

curl -X PUT https://api.mozout.com/v1/sms/otp-settings \
-H "Authorization: Bearer prod_..." \
-H "Content-Type: application/json" \
-d '{"resend_wait_seconds": 60, "max_codes_per_number_per_hour": 5}'

The values in the example are only a starting point: a minute between resends and five codes per number per hour are enough for genuine mistakes and stop abuse. Adjust them to your case.

With a Sandbox key, the change is simulated. In the Sandbox, writes do not change the account: the response includes "simulated": true and the rules stay as they were. To change them for real, use a Production key or My MozOut.

What these rules do not do

They limit by number. Someone abusing a form usually requests codes for many different numbers, and each number stays under the limit. So you also need brakes in your own system: by IP address, by session, a captcha and an alert when volume goes beyond normal. It is all in fraud through your code form.

When a limit is reached, the API refuses the request and says how long to wait. Show the customer a simple message such as “Too many codes requested. Please try again shortly.”, and see how to read the verification API's answers.

Want to stop abuse of your verification codes? See Verification SMS.

See Verification SMS

Categories

Categories