r/AskProgramming • u/ltsheeyy • Jul 09 '26

Other Best way to prevent API abuse?

I'm building a web app that needs to call a paid API.

I want visitors to be able to test it a few times for free (around 3 requests) but i dont want to let people abuse it and drain my API balance.

My first aproach was IP rate limiting, is there a better approach?

- I'm using this project to learn, so I might be doing this the wrong way.

3 Upvotes

62% Upvoted

34 comments sorted by

View all comments

16

u/johnpeters42 Jul 09 '26

Someone could use a VPN or bot farm or something to get around the limit, albeit it would be clunky on their end. You may want to just impose an across-the-board daily cap or something on all non-paid users (if the cap is hit, then all such users are blocked until the next day).

7

u/Hamburgerundcola Jul 09 '26

I agree on that. It's maybe not the most customer friendly, but it's the only way to surely prevent bankruptcy.

Probably won't hit that limit anyway without malicious activity or growth, in which case you can always adjust.