For endpoints that trigger costly third-party operations, enforce per-user quotas that limit total consumption in a time window — not just request frequency. These quotas are separate from general rate limits because one request can be much more expensive than another.
Examples by operation type:
• AI inference: 100 requests/day per free user, 1,000 requests/day per paid user. Track cumulative tokens or calls, not just request count.
• SMS OTPs: 10 sends/hour per phone number, 50 sends/day per user account.
• Email sends: 5 send/minute, 500 sends/day per user.
• File transcoding: 10 minutes of video/day per free tier.
In addition to per-user quotas: set hard billing caps with your cloud provider and third-party services. Configure alerts when spending crosses 50%, 75%, and 100% of your monthly budget. This is a financial backstop when limits are misconfigured or bypassed.
Cloud billing alerts are delayed — they report on already-spent money. They're a fallback, not a defense. Rate limiting and quotas must be enforced at the API layer in real time. The alert fires after the damage; the rate limit prevents it.
Ask your team whether long-running operations run synchronously inside an API request or asynchronously in the background. Synchronous expensive operations mean a flood of requests can take down the service.