What is Rate limit?

A cap on how often someone may do something, like 10 requests a minute, to stop abuse and runaway bills.

Where Rate limit goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Bills that explode · 4 minutes · Pro
The 40,000 SMS codes
Your phone sign-in sends a code by SMS. Overnight it sent 40,000 codes to numbers in countries you do not serve.
What is SMS pumping fraud?
SMS pumping is when attackers trigger thousands of verification texts to number ranges whose carriers share the fees with them, using your sign-in or invite endpoint and your SMS bill. Prevent it with rate limits per number and IP address, allowing only countries you serve, bot checks before sending, and alerts on unusual volume.
Read the fix
Accounts and privacy · 4 minutes · Free
Six digits, endless guesses
Your app signs people in with a 6-digit code sent by email. A security researcher writes: 'I got into your demo account without access to its inbox.'
Can someone guess a 6-digit login code?
Yes, if wrong guesses aren't limited. Six digits is one million possibilities, which a script can try in hours. Limit wrong attempts per code, for example to five, then cancel it; expire codes within minutes; make each code single use; and rate-limit the endpoint that checks codes, not only the one that sends them.
Walk it, free
Getting paid · 4 minutes · Pro
200 declined payments in an hour
Your $5 tip jar had 214 payment attempts overnight. 203 were declined. Stripe has emailed you about unusual activity.
What is card testing and how do I stop it?
Card testing is when fraudsters use your payment form to check which stolen card numbers work, with many small attempts in a short time. Successful charges later become disputes with fees, and high decline rates can put your payment account at risk. Rate-limit attempts, add a bot check, require sign-in or a minimum amount, and enable fraud rules.
Read the fix
Bills that explode · 4 minutes · Pro
A quiet week, a loud bill
Almost nobody visited your site this week. Your hosting bill is forty times higher than usual.
Why is my hosting bill high with few visitors?
On usage-based hosting you pay for every request, compute second and gigabyte, whether a person or a bot sent it. AI crawlers can send tens of thousands of requests that each trigger paid work. Block unwanted crawlers at your host, cache expensive pages and images, and set a hard spend limit.
Read the fix
Bills that explode · 4 minutes · Pro
500 signups overnight
You give every new account 50 free AI credits. You wake up to 500 new signups and no new customers.
How do I stop fake accounts abusing my free tier?
Make farming expensive and real signups easy: verify email before granting free credits, normalise addresses such as Gmail dot variants, rate-limit signups per IP address, and add a bot check. No single step stops a determined abuser; several small ones together make it not worth the effort.
Read the fix
Keeping it running · 4 minutes · Pro
The AI that went quiet
Your app's Summarise button worked for months. Since Saturday it spins, then shows nothing. You haven't changed a line.
What does OpenAI insufficient_quota mean?
insufficient_quota is a 429 error that means your OpenAI account ran out of prepaid credits or hit its spend limit. Retrying will not help: calls fail until credits are added or the limit is raised. Set up a balance alert or auto-recharge, keep a spend cap, and alert yourself whenever an AI call fails.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Authentication: Checking who someone is, usually by signing in.
Crawler: A program that visits websites automatically, for search engines, AI training, or abuse.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

All 62 terms in the glossary

Where Rate limit goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Bills that explode · 4 minutes · Pro

The 40,000 SMS codes

Your phone sign-in sends a code by SMS. Overnight it sent 40,000 codes to numbers in countries you do not serve.

What is SMS pumping fraud?

SMS pumping is when attackers trigger thousands of verification texts to number ranges whose carriers share the fees with them, using your sign-in or invite endpoint and your SMS bill. Prevent it with rate limits per number and IP address, allowing only countries you serve, bot checks before sending, and alerts on unusual volume.

Read the fix

Accounts and privacy · 4 minutes · Free

Six digits, endless guesses

Your app signs people in with a 6-digit code sent by email. A security researcher writes: 'I got into your demo account without access to its inbox.'

Can someone guess a 6-digit login code?

Yes, if wrong guesses aren't limited. Six digits is one million possibilities, which a script can try in hours. Limit wrong attempts per code, for example to five, then cancel it; expire codes within minutes; make each code single use; and rate-limit the endpoint that checks codes, not only the one that sends them.

Walk it, free

Getting paid · 4 minutes · Pro

200 declined payments in an hour

Your $5 tip jar had 214 payment attempts overnight. 203 were declined. Stripe has emailed you about unusual activity.

What is card testing and how do I stop it?

Card testing is when fraudsters use your payment form to check which stolen card numbers work, with many small attempts in a short time. Successful charges later become disputes with fees, and high decline rates can put your payment account at risk. Rate-limit attempts, add a bot check, require sign-in or a minimum amount, and enable fraud rules.

Read the fix

Bills that explode · 4 minutes · Pro

A quiet week, a loud bill

Almost nobody visited your site this week. Your hosting bill is forty times higher than usual.

Why is my hosting bill high with few visitors?

On usage-based hosting you pay for every request, compute second and gigabyte, whether a person or a bot sent it. AI crawlers can send tens of thousands of requests that each trigger paid work. Block unwanted crawlers at your host, cache expensive pages and images, and set a hard spend limit.

Read the fix

Bills that explode · 4 minutes · Pro

500 signups overnight

You give every new account 50 free AI credits. You wake up to 500 new signups and no new customers.

How do I stop fake accounts abusing my free tier?

Make farming expensive and real signups easy: verify email before granting free credits, normalise addresses such as Gmail dot variants, rate-limit signups per IP address, and add a bot check. No single step stops a determined abuser; several small ones together make it not worth the effort.

Read the fix

Keeping it running · 4 minutes · Pro

The AI that went quiet

Your app's Summarise button worked for months. Since Saturday it spins, then shows nothing. You haven't changed a line.

What does OpenAI insufficient_quota mean?

insufficient_quota is a 429 error that means your OpenAI account ran out of prepaid credits or hit its spend limit. Retrying will not help: calls fail until credits are added or the limit is raised. Set up a balance alert or auto-recharge, keep a spend cap, and alert yourself whenever an AI call fails.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Authentication

Checking who someone is, usually by signing in.

Crawler

A program that visits websites automatically, for search engines, AI training, or abuse.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.