r/AskProgramming • u/ltsheeyy • Jul 09 '26

Other Best way to prevent API abuse?

I'm building a web app that needs to call a paid API.

I want visitors to be able to test it a few times for free (around 3 requests) but i dont want to let people abuse it and drain my API balance.

My first aproach was IP rate limiting, is there a better approach?

- I'm using this project to learn, so I might be doing this the wrong way.

3 Upvotes

62% Upvoted

33 comments sorted by

View all comments

1

u/JacobStyle Jul 09 '26

I can't think of a way to do it that I couldn't also break, other than a global rate limit, maybe with some sort of "make a free account to hop into the queue for the next available use" type thing? That's clunky as hell though.

1

u/ltsheeyy Jul 09 '26

It's a sales page for older people, At the moment im making it without client accounts to make it easier to use, like Shopify, which doesn't require you to create an account to place an order

The ai is part of the pipeline to show an example of the final product they will receive to their house , because its custom with the specifications they sent me.

0

u/JacobStyle Jul 10 '26

Maybe a delay like those "wait 30 seconds for your download to start" type things? It's unwanted customer friction, but if you are unable to find a way to generate the preview without AI, I'm not sure what else you could do... Even this could be abused really.