What could your AI feature cost you?

An app with 60 users made 2 million AI requests in one night. Work out your normal monthly bill, and what an unprotected endpoint costs once a bot finds it.

  • Monthly cost from tokens and traffic
  • The cost of one night of abuse
  • Runs in your browser
Example price tiers

Typical price levels, not quotes. Use your model's real prices for your own numbers.

From your provider's pricing page.
Output usually costs several times more.
Per request: prompt + context. A page of text is about 700.
Per request. A paragraph is about 100.
Normal use, all your users together.
300 is one modest script.
Overnight is about 8.

Your estimate

Normal month

$81.00

$0.0135 per request

One night, endpoint left open

$1,944

144,000 requests: 24 months of your normal bill

What keeps the second number at zero

  • Only signed-in users can call the AI feature, checked on the server.
  • A limit per user (say 20 requests an hour), enforced on the server.
  • A spending cap and an alert in your AI provider's dashboard.
  • The API key lives on the server, never in the page.

Check your key is not in your site's code

How AI bills explode

Every AI request costs money: you pay for the tokens you send and the tokens you get back. In normal use that is small. The problem is an endpoint anyone can call: a summarise button, a chat route, an image generator that does not check who is asking or how often.

Bots find these within days. One script, running all night, sends hundreds of requests a minute, and the bill arrives at the end of the month. If the key is in your page's code, they do not even need your endpoint.

How to cap the risk

  1. Require sign-in for every AI feature, and check it on the server, not only in the page.
  2. Limit requests per user and per IP address, on the server.
  3. Set a monthly spending limit and an alert in your provider's dashboard.
  4. Keep the key on the server and scan your site to confirm it is not in the page.
  5. Cache answers to repeated questions so the same request is not paid for twice.

Questions

What is a token?
The unit AI providers charge by: roughly three quarters of a word in English. A page of text is about 700 tokens. You pay separately for the tokens you send (input) and the tokens the model writes (output), and output usually costs several times more.
Are these real prices?
The presets are typical price levels for small, mid-size and large models, not quotes for any named model; prices change often. Enter your model's prices from your provider's pricing page for your own numbers.
Isn't my provider's rate limit enough?
No. Provider rate limits protect the provider, and they are high enough to let a bot spend a lot. You need your own limits per user, plus a spending cap in the dashboard.