Skip to main content

Solutions · Security & abuse prevention

Stop abuse
before it bills you.

Rate limits per user, caps per tier, shared budgets, and a global backstop, checked inside your app before the model runs.

Start freeBook a demo
A script on one free API key · 50 requests a second
0s20s
sentreached the model
Sent1,000
Reached the model29
Stopped in your app971
Your model bill$0.12capped at $4.00 a day by the Free daily cap
Rate limitburst 10 · then 1 a secondstopped 971
Daily cap · Free1,000 requests29 used
Org budget$50 a day, shareduntouched
Global backstop$5,000 a day, everyoneuntouched
Made-up attack rate and cost per call · the rate limit behaves as on engine 0.8.5

The problem

Abuse shows up
on the invoice.

A leaked key, a scraper, a thousand throwaway free accounts. Every abusive call costs you real money, and gateway rate limits count requests, not dollars.

Leaked key
41,200
calls overnight, all on one key
Scraper
3 / sec
for nine days, under the rate limit
Free signups
1,000
new accounts, no card on file
every call passed the gateway■ every call was billed to you

How it works

Layers that know
the customer.

Every call is checked against every layer that applies: the user's rate, their plan's daily cap, their org's budget, and one backstop over everyone. Whichever runs out first stops the call.

Policy · livePolicy
Live, no unpublished changes · v23
EntitlementFreefree · defaultProproScalescale
api · rateBurst, then a steady raterate limit
api · dailyRequests a dayhard cap
chatModel tokens a monthlimit
org budgetSpend a day, sharedcap
backstopSpend a day, every customercap
trialBefore a card is on fileflag
Limitr Cloud policy editor · made-up plans · click any setting

Defense in depth

A ceiling on
every bad day.

The same policy that prices your product limits it. No separate gateway, no second set of rules to keep in sync with your plans.

Rate limits per user

A burst, then a steady rate, per user, API key, or org. A script gets its burst and then one call a second.

Caps per tier

Free gets a daily cap, Pro a higher soft one. New accounts get no AI until a card is on file, so farming free accounts stops paying off.

Budgets and backstops

A shared budget per org, and one backstop over every customer. Count what customers pay or what calls cost you, so a bad day has a ceiling.

Pause the key

Take access away from one customer in a single call. It comes back on its own after a set time, or when you say.

Signals

See the attack
as it happens.

Every denial is an event with the customer, the plan, and the reason: over the rate, over a cap, at the backstop. Send them to Slack or your pager.

#abuse-alertsfrom Limitr events
  1. 12:04:31meter-governedbot42 · Free49 calls over the rate limit in 1s
  2. 12:04:32customer-entitlement-takenbot42 · FreeAPI access paused for 24 hours
  3. 12:09:10cap-threshold-crossedAcme · Pro80% of the $50 daily org budget
  4. 12:15:47meter-limit × 3838 Free accounts created todayEach hit its daily cap within 10 minutes
  5. 12:16:02cap-limitEveryoneGlobal backstop reached: AI paused, alert sent
Made-up events

Under the hood

Checked before
the model runs.

Every layer runs inside your app in Limitr's open-source, sandboxed engine. No extra hop to slow the check down or skip it, and it keeps working if the network doesn't.

How the engine works →
Limitr Cloudedit
entitlementfree
api · rate10 burst · 1 / sec
api · daily1,000
chat50k tokens
Changed by sales, support, or you
policy.yamlsame policy
policy:
  plans:
    free:
      entitlements:
        api:
          limit: { credit: request, value: 1000,
                   governor_enabled: true,
                   governor_capacity: 10,
                   governor_refill_rate: 0.001 }
Your appengine inside
limitr engine
await limitr.allow('bot42', 'api', 1)
→ false
The 11th call in a burst is refused, with a meter-governed event.
one cell · one line · every engine■ runs in your process

Give abuse
a ceiling.

npm i @formata/limitr
Start freeBook a demo