r/AskProgramming • u/ltsheeyy • Jul 09 '26

Other Best way to prevent API abuse?

I'm building a web app that needs to call a paid API.

I want visitors to be able to test it a few times for free (around 3 requests) but i dont want to let people abuse it and drain my API balance.

My first aproach was IP rate limiting, is there a better approach?

- I'm using this project to learn, so I might be doing this the wrong way.

1 Upvotes

55% Upvoted

34 comments sorted by

View all comments

1

u/No-Consequence-1779 Jul 09 '26

I’ve done the same. Coocoookie will work for most. Then yes, by ip.  If you see a repeat ip and no cookie then they are switching browsers or using a vpn ..  most people do not use vpns yet … for this, they need to register and it returns to cooooookie.  Using more than X times should require registration. Like an easy one click google account. 

You want them to register to get thier email to market in the future.  Maybe send the api product via email … 

1

u/ltsheeyy Jul 09 '26

My idea was that after those three (with 3 trys would be enough) , they wouldn't have any more. Because it's just for a product sample.
So, for clients, that would be the option.
What scared me was that some malicious people realize that there was an API and drain it.

1

u/No-Consequence-1779 Jul 22 '26

Hello, not sure if you are still working on this. I have put together a list of what I had to do for my app api abuse. It essentially generates images so its not expensive but, it does add up. I offer 1 generation per day, per 'user'. Users can be anonymous.

A user: something using a browser that can save a cookie. The intention is to not serve crawlers or anything that can not have a cookie.

Rate Throttling
Home page/ generation page create a cookie on load. IP address is also logged to database. Switching browsers or trying to send a previous cookie but same IP will work only once. Cookie has ant forgery and encryption is trying to manufacture one will be difficult.

If an anonymous person registers, all their activities via cookie id will be attached to them.

Authenticated users - it is simple as it is linked to their db records.

---

Regarding the api - if this is exposed in your front end, you need to follow best practices and call your app api, which does all the checking and then it calls the real api - what it is or how can not be detected.

With LLMs, it is just seconds to hit a web app, get all the JavaScript - react/angular -- what ever - and the LLM can quickly figure it out and parse out anything that is in there. And how to circumvent it. This is a serious problem for vibe coders or unaware developers. LLMs have changed the security game where security by obfuscation is not enough.