This post was created with AI assistance and reviewed for accuracy before publishing.Rate limiting a normal API protects...

This post was created with AI assistance and reviewed for accuracy before publishing.Rate limiting a normal API protects your servers. Rate limiting an LLM API protects your bank account. The difference matters, because it changes what you are counting and where the limit has to live.A conventional web endpoint costs you CPU time measured in milliseconds. A single model call can cost real money, and an agent loop can issue hundreds of them without a human ever clicking anything. One customer leaving a misconfigured retry loop running overnight is a bill, not a blip. Count tokens, not just requestsThe instinct is to limit requests per minute. That is necessary but not sufficient, because requests vary in cost by three orders of magnitude. A one-line prompt and a 200-page document summarisation are both "one request".Track both, and enforce whichever binds first:// Two windows, different units, same tenant.await Promise.all([ consume(`rl:${tenantId}:req`, 1, 60), // 60 requests / minute ...