What happens when one customer floods your API?
Only that customer hits a limit. Every other restaurant keeps booking tables like nothing happened.
APIblaze checks every call before it reaches your API, answers floods with a standard 429, and caps your total traffic and monthly bill. Change any limit without a redeploy.
Put limits in front of your API
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yamlPaste it in a terminal. No sign-up, no servers. The link is a sample restaurant API; swap in your own API’s address. Limits are on from the start: 10 calls a second per caller and 3,000 a day.
The noisy neighbour
Three restaurants use your booking API. One of them ships a bug that calls you in a loop. Watch what happens to the other two, with and without a limit on each key.
Nino’s Pizza
Fine5 calls a second · 5 answered
Bella Trattoria
Fine4 calls a second · 4 answered
Sushi Go
Fine3 calls a second · 3 answered
The line is each key’s own limit: 10 a second, the default. The striped part is refused before it reaches your API.
Three dials, sensible from the start
Every API starts with a rate limit and a quota already set. Turn them up or down whenever you like.
Rate per caller
10 a second
How fast each key, or each signed-in caller, may call. Every customer gets their own.
--rate 10Quota
3,000 a day
How much the whole API may serve in a day, a week or a month.
--quota 3000 --period dailySpend cap
$50 a month
What your API may cost you in a month. Off until you set it; the $50 is an example.
--spend-cap 50What a limited caller gets back
A caller over its limit doesn’t get a timeout or a mystery error. It gets a standard answer, so well-behaved clients slow down on their own.
GET /bookings · X-API-Key: sk_prod_…
HTTP/1.1 429 Too Many Requests
RateLimit-Policy: "key";q=100;w=10
RateLimit: "key";r=0;t=1
Retry-After: 1
Content-Type: application/problem+json
{
"type": "https://apiblaze.com/problems/rate-limited",
"title": "Rate limit exceeded",
"status": 429,
"retry_after_s": 1
}
Three nets under one runaway agent
An AI assistant stuck in a loop can call your API 1,200 times a minute, all day. With nothing in front of your API, that is an outage by lunch and a bill you find next month.
APIblaze catches it three times over.
An AI agent in a loop: 1,200 calls a minute, and it isn’t stopping.
Build your limits command
Drag the settings and copy the command. It is the same as changing them in your dashboard.
Your command
$ npx apiblaze@latest limits set myapi --rate 10 --quota 3000 --period daily --spend-cap 50Run it any time; the new limits apply without a redeploy. The same settings are in your dashboard. Need more than the self-serve maximum rate? limits request-max asks for it.
Common questions
How do I rate-limit my API per customer?
Put APIblaze in front of it. Every customer’s API key, and every signed-in caller, gets its own rate limit, 10 calls a second to start, and you change it with one setting.
Can I set a quota per customer?
Coming soon. Today, every customer’s key gets its own rate limit, and quotas apply to your whole API and your team.
What is the difference between a rate limit and a quota?
A rate limit caps how fast someone can call, per second. A quota caps how much your API serves in total, per day, week or month.
What does a caller get when they hit a limit?
A 429 with standard RateLimit and Retry-After headers and a short JSON explanation, so client libraries can back off on their own.
What is a spend cap?
A monthly limit on what your API can cost you. When it is reached, calls are refused instead of the bill growing.
Do limits apply to AI agents using my MCP server?
Yes. An agent calls with a person’s key or sign-in, so the same per-caller limit applies, and a loop is held to it.
Can I change the limits later?
Any time, from your dashboard or with the limits command, without a redeploy. If you need more than the self-serve maximum rate, you can ask for it.
Does it cost extra?
No. Limits are part of the gateway, and you pay per request with no subscription.
Prices are on the pricing page.
Put limits in front of your API
No sign-up, no servers. A rate limit on every customer’s key, a quota and a spend cap, from the first call.
$ npx apiblaze@latest create --target https://ninopizzas.com/openapi.yaml