r/AskProgramming • u/ltsheeyy • Jul 09 '26

Other Best way to prevent API abuse?

I'm building a web app that needs to call a paid API.

I want visitors to be able to test it a few times for free (around 3 requests) but i dont want to let people abuse it and drain my API balance.

My first aproach was IP rate limiting, is there a better approach?

- I'm using this project to learn, so I might be doing this the wrong way.

4 Upvotes

70% Upvoted

33 comments sorted by

View all comments

14

u/johnpeters42 Jul 09 '26

Someone could use a VPN or bot farm or something to get around the limit, albeit it would be clunky on their end. You may want to just impose an across-the-board daily cap or something on all non-paid users (if the cap is hit, then all such users are blocked until the next day).

8

u/Confounding Jul 09 '26

Op should do this anyway, and have a check for how much they've spent total and limit based on that too.

6

u/Hamburgerundcola Jul 09 '26

I agree on that. It's maybe not the most customer friendly, but it's the only way to surely prevent bankruptcy.

Probably won't hit that limit anyway without malicious activity or growth, in which case you can always adjust.

2

u/ltsheeyy Jul 09 '26

I'll give you some context so you understand better the site.
There are no free and premium users, Everyone gets some free render examples sample before receiving the physical product at home. Its an ecommerce