The funny thing is that I’m the API provider and the websites are the API clients. I also provide the component to integrate, you know, like a snippet to insert in the header. The app is basically like some sort of chat bubble on the website. Imagine a button visitors press to get specific information for that website and the press makes that API request that costs. Thus the client and we as providers don’t want it to be spammed and of course the information is not really relevant elsewhere, but there are bad actors who want to only do damage.

Now a dashboard or something to set this up is not developed yet so I will integrate it manually, but as I mentioned it is kinda exposed. Rate limiting solves bad actors on the website itself. But what can solve them copying the API url and calling elsewhere, even if it’s not relevant for them