How to protect your backend from abuse and traffic spikes?
Limit how fast each caller can go and how much your API serves in total, and turn the extra calls away before they reach your backend.
It looks like a simple counter, until you have many servers, many customers and AI agents that never stop. Here’s what it really takes, and the easy way to solve it.
Skip to the one-command wayA counter sounds simple. Real limits aren’t.
To protect a backend that many customers share, every request has to be checked before it gets through. Here is what that takes.
One request. Before it may reach your backend, it has to pass every one of these, in a few milliseconds:
1. Who’s calling?
A limit for each caller
One shared limit lets a single noisy customer use it up for everyone.
2. How many so far?
A counter every server shares
Five servers counting on their own let through five times the limit.
3. Quick enough?
Counting without the wait
It runs on every request, so a slow counter slows your whole API.
4. Over the limit?
The right answer back
A 429 with Retry-After, or clients just retry harder.
5. Over today’s total?
A daily or monthly total
Per-second limits don’t stop a slow drain that runs all day.
6. Over the budget?
A cap on the cost
Without one, a runaway month shows up as a surprise bill.
Without them, one customer is everyone’s problem
Three restaurants use your booking API. One ships a bug that calls you in a loop. Watch what happens to the other two, with no limits and with a limit on each key.
Nino’s Pizza
Fine5 calls a second · 5 answered
Bella Trattoria
Fine4 calls a second · 4 answered
Sushi Go
Fine3 calls a second · 3 answered
The line is each key’s own limit: 10 a second, the default. The striped part is refused before it reaches your API.
Put limits in front of your API with one command
APIblaze runs every piece on that list. Point it at your API:
Put limits in front of your API
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yamlPaste it in a terminal. No sign-up, no servers. The link is a sample restaurant API; swap in your own API’s address. Limits are on from the start: 10 calls a second per caller and 3,000 a day.
APIblaze is an API proxy: every request passes through it first
It sits between your callers and your backend. Every call goes to APIblaze, and only the ones within their limits are passed on.
Callers
- Nino’s booking appasks to book a table
- Luigi’s app, stuck in a loopasks to list bookings ×1,200
- An AI agent, all day longasks to call your API after today’s 3,000
APIblaze
The API proxy
Counts every caller’s calls in one shared place and turns away the extra ones with a standard 429.
Your API
Only sees the calls APIblaze lets through.
Never reached your code.
That’s why it’s the right place for limits. It sees all your traffic at once, so it can count per caller and stop a flood before your backend feels it. A runaway agent gets caught three times over:
An AI agent in a loop: 1,200 calls a minute, and it isn’t stopping.
Limits on your API, step by step
- 1
Start with sensible limits, already set
Every API starts with a rate limit and a quota. The spend cap is off until you set one.
Rate per caller
10 a second
How fast each key, or each signed-in caller, may call. Every customer gets their own.
--rate 10Quota
3,000 a day
How much the whole API may serve in a day, a week or a month.
--quota 3000 --period dailySpend cap
$50 a month
What your API may cost you in a month. Off until you set it; the $50 is an example.
--spend-cap 50 - 2
Set your own, without a redeploy
Drag the settings and copy the command. It’s the same as changing them in your dashboard.
Your command
$ npx apiblaze@latest limits set myapi --rate 10 --quota 3000 --period daily --spend-cap 50Run it any time; the new limits apply without a redeploy. The same settings are in your dashboard. Need more than the self-serve maximum rate?
limits request-maxasks for it. - 3
Callers over the limit get a standard answer
Not a timeout or a mystery error: a 429 that well-behaved clients understand, so they slow down on their own.
GET /bookings · X-API-Key: sk_prod_…
HTTP/1.1 429 Too Many Requests
RateLimit-Policy: "key";q=100;w=10
RateLimit: "key";r=0;t=1
Retry-After: 1
Content-Type: application/problem+json
{
"type": "https://apiblaze.com/problems/rate-limited",
"title": "Rate limit exceeded",
"status": 429,
"retry_after_s": 1
}
Common questions
How do I rate-limit my API per customer?
Put APIblaze in front of it. Every customer’s API key, and every signed-in caller, gets its own rate limit, 10 calls a second to start, and you change it with one setting.
What is an API proxy?
A service that sits in front of your API. Every request goes through it first, so it can count each caller’s calls and turn away the extra ones before they reach your backend. APIblaze is an API proxy.
Can I set a quota per customer?
Coming soon. Today, every customer’s key gets its own rate limit, and quotas apply to your whole API and your team.
What is the difference between a rate limit and a quota?
A rate limit caps how fast someone can call, per second. A quota caps how much your API serves in total, per day, week or month.
What does a caller get when they hit a limit?
A 429 with standard RateLimit and Retry-After headers and a short JSON explanation, so client libraries can back off on their own.
What is a spend cap?
A monthly limit on what your API can cost you. When it is reached, calls are refused instead of the bill growing.
Do limits apply to AI agents using my MCP server?
Yes. An agent calls with a person’s key or sign-in, so the same per-caller limit applies, and a loop is held to it.
Can I change the limits later?
Any time, from your dashboard or with the limits command, without a redeploy. If you need more than the self-serve maximum rate, you can ask for it.
Prices are on the pricing page.
Protect your backend today
One command, no sign-up. Limits on from the first call.
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml