What are quota and spending limits?
Quota and spending limits are caps on how much of a paid service, like an AI model, SMS or email provider, your app can use in a day or month, and how much any single user can use. They stop a bug, a bot or a leaked key from running up a huge bill.
ON THIS PAGE
What it means
Many services charge per use: per AI message, per text, per email, per image. Without a cap, the cost is only limited by how fast someone can send requests.
There are two levels. A spending cap set in the provider's dashboard protects your whole account. A per-user limit inside your app stops one person from using it all.
Why it matters for vibe-coded apps
AI features are a favourite target: every request costs you money, and a public chat box with no limits is an open invitation for bots.
- A bot or a loop bug can run up a bill of thousands overnight.
- A single heavy user can use up everyone's quota.
- A leaked key makes it worse, because there is no cap to hit.
Example
An AI chat endpoint that anyone can call.
app.post("/api/chat", async (req, res) => {
const reply = await openai.chat.completions.create({ ... });
res.json(reply);
});app.post("/api/chat", requireLogin, async (req, res) => {
const used = await countToday(req.user.id);
if (used >= 50) return res.status(429).json({ error: "Daily limit reached" });
const reply = await openai.chat.completions.create({ max_tokens: 500, ... });
res.json(reply);
});Also set a monthly spending cap and a billing alert in the provider's dashboard.
How to check if your app has this problem
- 1Open the billing page of each paid service you use and look for a hard cap or alerts.
- 2Check each paid route in your app for a limit on how often one user can call it.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Set a monthly spending cap and email alerts with each provider.
- 2Require login for every route that costs money.
- 3Add a per-user daily limit and a maximum request size.
- 4Watch your usage for a week after launch.
Add usage limits to every route in my app that calls a paid service. Require login, limit each user to a daily number of calls, cap the size of each request, return a 429 when the limit is reached, and log usage per user.
Check if your app has this problem
Paste your website and we'll check for quota and spending limits issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Rate limitingA cap on how many requests someone can make in a set time.
- API key exposureA secret key for a paid service ends up where the public can see it.
- Prompt injectionHidden instructions that trick an AI feature into ignoring your rules.
- Brute-force attackSomeone tries thousands of passwords until one works.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.