How to stop strangers running up your AI bill

How an AI app gets used for free

Most AI apps have a server route, such as /api/chat, that takes a message, sends it to an AI provider with your key, and returns the answer. Your website calls it, but so can anyone else who finds the address. If it doesn't check who's asking, every request is billed to you.

Because these routes are easy to spot in a browser's network tab, people do find them and use them as a free AI service.

Five protections worth adding

• Require a login, or at least a session your own site issued, before the route will call the AI provider.
• Rate-limit each user and each IP address, so one visitor can't send thousands of requests.
• Cap the size of each request and response (message length and maximum output tokens).
• Set a monthly spend limit or budget alert with your AI provider. It's the safety net if everything else fails.
• Keep your provider key on the server. If the browser can see it, anyone can skip your route and use the key directly.

How to check your app

Open your app's public chat or agent address from a private browser window or a different device. If it answers a request without asking you to log in, so will it for a stranger.

Our free scan checks this for you. Once you've proved you own the app, it sends one tiny message to see whether your route answers without a login, and tells you where to add the check.