How do I secure a public API without login?

Use rate limiting by IP, API keys for free tier, CAPTCHA for forms, and WAF rules. Monitor traffic and set billing alerts. Even without auth, you can limit abuse.

What rate limit should I use for public APIs?

Start with 100-500 requests per minute per IP. Adjust based on your cost per request and typical usage. Add stricter limits for free tier API keys.

Can I prevent API abuse without requiring signup?

Yes. IP-based rate limiting, CAPTCHA, and WAF rules work without authentication. For higher limits, require a free API key (email signup).

Prevent API Abuse Without Authentication | StackRail

What this problem means

You have a public API—maybe a free tier, a landing page form, or a public endpoint—and you can't require users to sign up. Without authentication, anyone can hit your API. Abuse is inevitable: scrapers, bots, and cost amplification.

Why this is dangerous

- Cost amplification: Each request may trigger expensive downstream calls (AI APIs, databases). Unlimited requests = unlimited bills.

- Scraping: Competitors or bad actors extract your data at scale.

- Denial of service: A flood of requests can overwhelm your servers.

Real-world example

A startup offered a free "try our AI" API with no signup. A script was written to automate millions of requests. Within a week, the API was called 10M+ times. The startup had no rate limits, no per-IP caps, and no alerts. The resulting OpenAI and infrastructure bills exceeded $80,000.

How to fix it

1. Rate limiting by IP: Cap requests per IP per minute. Even without auth, this stops most abuse.

2. API keys for free tier: Require a free API key (email signup). Tie limits to the key.

3. CAPTCHA or hCaptcha: For public forms, add CAPTCHA to block bots.

4. WAF rules: Cloudflare or AWS WAF can block known bad actors and suspicious patterns.

5. Monitor and alert: Set up alerts for unusual traffic spikes.

Tools and configurations

- Cloudflare: Rate limiting rules at the edge, no code changes.

- AWS API Gateway: Throttling and usage plans.

- express-rate-limit: Node.js middleware for per-IP limits.

- hCaptcha / reCAPTCHA: Bot protection for forms.

Common mistakes

- Assuming "we're too small to be targeted."

- Only limiting by IP (proxies can bypass).

- No monitoring—discovering abuse when the bill arrives.

Quick checklist

- [ ] Add rate limiting by IP or API key

- [ ] Consider free API keys for anonymous tier

- [ ] Add CAPTCHA for public forms

- [ ] Set up billing and traffic alerts

- [ ] Use WAF for known bad actors

Need help with production readiness? Get a free 30-minute audit.

Book Free 30-Min Production Audit

View our DevSecOps services

Check if your system has this risk

Take the 60-second production readiness assessment to identify gaps in your infrastructure.

Start Assessment

Frequently asked questions

How do I secure a public API without login?: Use rate limiting by IP, API keys for free tier, CAPTCHA for forms, and WAF rules. Monitor traffic and set billing alerts. Even without auth, you can limit abuse.
What rate limit should I use for public APIs?: Start with 100-500 requests per minute per IP. Adjust based on your cost per request and typical usage. Add stricter limits for free tier API keys.
Can I prevent API abuse without requiring signup?: Yes. IP-based rate limiting, CAPTCHA, and WAF rules work without authentication. For higher limits, require a free API key (email signup).