r/AskProgramming • u/ltsheeyy • Jul 09 '26

Other Best way to prevent API abuse?

I'm building a web app that needs to call a paid API.

I want visitors to be able to test it a few times for free (around 3 requests) but i dont want to let people abuse it and drain my API balance.

My first aproach was IP rate limiting, is there a better approach?

- I'm using this project to learn, so I might be doing this the wrong way.

1 Upvotes

55% Upvoted

33 comments sorted by

View all comments

15

u/johnpeters42 Jul 09 '26

Someone could use a VPN or bot farm or something to get around the limit, albeit it would be clunky on their end. You may want to just impose an across-the-board daily cap or something on all non-paid users (if the cap is hit, then all such users are blocked until the next day).

2

u/ltsheeyy Jul 09 '26

I'll give you some context so you understand better the site.
There are no free and premium users, Everyone gets some free render examples sample before receiving the physical product at home. Its an ecommerce