Rate limits and the bill-shock trap

Two more things the menu doesn't shout about but will absolutely bite you.

Rate limits. APIs cap how many requests you can make in a window of time — say 100 per minute. Go over and you get rejected with a 429 Too Many Requests error until you slow down. This exists to stop one customer from overwhelming the service. The trap: AI-written code often calls an API in a loop with no pause, blowing through the limit instantly. If a feature works for one item but breaks when you run it over a thousand, a rate limit is a prime suspect.

Metered and paid APIs. Many APIs charge per request — fractions of a cent each. That's nothing for a few calls and a real bill when something loops out of control. The classic horror story: a bug retries a failed paid call forever, or a public form lets strangers trigger paid calls, and you wake up to a four-figure invoice. Protect yourself:

• Read the pricing before you wire up a paid API. Know the cost per call.
• Set a spending cap or budget alert in the provider's dashboard if they offer one. Most do.
• Be suspicious of any code that calls a paid API inside a loop or on every page load.