diff --git a/users/views.py b/users/views.py
index c08da1b..9164260 100644
--- a/users/views.py
+++ b/users/views.py
@@ -8,6 +8,7 @@ from django.utils import timezone
 from django.views import View
 from rest_framework import generics, permissions, status
 from rest_framework.response import Response
+from rest_framework.throttling import UserRateThrottle
 from rest_framework.views import APIView
 from rest_framework.exceptions import AuthenticationFailed
 from rest_framework_simplejwt.tokens import RefreshToken
@@ -61,6 +62,7 @@ class UserProfileAPIView(generics.RetrieveUpdateAPIView):
 
     serializer_class = UserSerializer
     permission_classes = [permissions.IsAuthenticated]
+    throttle_classes = [UserRateThrottle]
 
     def get_object(self):
         return self.request.user
@@ -70,6 +72,7 @@ class ChangePasswordAPIView(APIView):
     """API endpoint for changing password."""
 
     permission_classes = [permissions.IsAuthenticated]
+    throttle_classes = [UserRateThrottle]
 
     def post(self, request):
         serializer = ChangePasswordSerializer(
@@ -89,6 +92,7 @@ class DeviceTokenAPIView(generics.ListCreateAPIView):
 
     serializer_class = DeviceTokenSerializer
     permission_classes = [permissions.IsAuthenticated]
+    throttle_classes = [UserRateThrottle]
 
     def get_queryset(self):
         return DeviceToken.objects.filter(user=self.request.user)
@@ -99,6 +103,7 @@ class DeviceTokenDeleteAPIView(generics.DestroyAPIView):
 
     serializer_class = DeviceTokenSerializer
     permission_classes = [permissions.IsAuthenticated]
+    throttle_classes = [UserRateThrottle]
 
     def get_queryset(self):
         return DeviceToken.objects.filter(user=self.request.user)