The open summarise button
Your app has a free 'summarise this PDF' button. Your AI bill says you made 2 million requests last night. You have 60 users.
This answers: How do I stop people abusing my app's AI endpoint? No coding needed. 3 quick decisions.
- Costs and abuse
- How a request travels
Step 1 of 3
Your logs show this. What happened?
02:14:07 POST /api/summarise 200 user=- ip=203.0.113.44 tokens=3,91202:14:07 POST /api/summarise 200 user=- ip=203.0.113.44 tokens=4,10402:14:08 POST /api/summarise 200 user=- ip=203.0.113.44 tokens=3,877How do I stop people abusing my app's AI endpoint?
Require sign-in, limit requests per user and per IP address, and cap the size of each request's input and output. Hiding the on your server is necessary but not enough: the endpoint that uses the key is public, and a script can call it millions of times.
Breaks at Your server: No sign-in, no limits, your bill
How it works
| Day | People | Bots |
|---|---|---|
| Mon | 180 | 260 |
| Tue | 210 | 300 |
| Wed | 160 | 9400 |
| Thu | 190 | 12100 |
| Fri | 230 | 14800 |
| Sat | 120 | 13300 |
| Sun | 110 | 11900 |
Why AI tools write this bug
AI tools correctly move the key to a server route, then leave that route open to anyone, with no limits, because limits are invisible in a demo.
How to fix it
- Require a signed-in user for any endpoint that spends money.
- Add per-user and per-IP .
- Cap input size and output length per request.
- Keep the provider's spend limit as a last line, not the plan.
Check your own app
Paste this into Lovable, Cursor or Claude Code:
List every endpoint or server action in this project that calls a paid API (OpenAI, Anthropic, image or email services). For each, tell me: does it require sign-in, is there a per-user or per-IP rate limit, and is the input size capped? Do not change code.
Common questions
- Isn't the provider's spending limit enough?
- No. It applies to your whole account, can lag behind usage, and does nothing to stop one abuser using all of it.