School · Module 6 · Lesson 1 of 4
Rate limit expensive and auth endpoints
Without limits, one script can burn your AI budget or spray login attempts.
Put per-user and per-IP limits on model calls, login, password reset and checkout session creation.
Return 429 with a Retry-After when possible. Log the route and key that tripped the limit.
Pair with bot protection on public forms (CAPTCHA or similar) when abuse shows up.