Hacker News Reader

Another thing to be aware of -- apparently their billing limits don't work. Somehow someone was able to use my key from Singapore. It had a $10 daily limit and they were able to spend $100. Not only that, it got me blocked from all models for the frontier labs.

On top of that, near as I can tell, there are no protections for your API key. No restrictions by country, IP, etc...

View on HN

Just chiming in that I've never had this experience with them. I set, hit, and depend on those limits regularly. I would be wildly interested in reading what their support analysis had to say about this situation, if such a postmortem was done.

So far it was just "investigating". From the logs, my best guess is they sent all the requests at approximately the same time, and whatever limiting they do doesn't react fast enough.

I get it, the API key was my responsibility, but, setting the dollar limit is exactly the guard they suggest against that.

We do now indeed have IP restrictions for API keys

I think that's only on the enterprise plans? So no real protection for those of us using open router personally? Or did I miss other protections somewhere?

Reply on news.ycombinator.com