How to implement per-user rate limits in your AI app

1. Decide on the unit and window

Common combos: requests/minute (anti-abuse), images/day (cost cap), tokens/month (margin cap). You can stack multiple - Vevee applies all matching limit groups to a single event.

2. Define limit groups in the dashboard

Create a limit group per cap. For example: "anti-abuse: 60 requests / minute / user", "cost cap: 100 image renders / month / user", "margin cap: 100k tokens / month / user". Match rules route events into them.

3. Reserve before the AI call

reserve() atomically holds quota. If allowed=false, return a clean 429 to the caller - do not call OpenAI / Replicate / etc.

const r = await vevee.reserve(userId, "image.render", 1, { model: "flux-pro" });
if (!r.allowed) {
  return new Response(
    JSON.stringify({ error: "rate_limited", reasons: r.reasons }),
    { status: 429 },
  );
}

4. Commit on success, release on failure

Wrap the AI call in try/catch. On success, commit. On failure, release. The reservation auto-releases after 60 seconds if your code crashes.

try {
  const result = await callAiProvider();
  await vevee.commit(r.reservationId!);
  return result;
} catch (err) {
  await vevee.release(r.reservationId!);
  throw err;
}

5. Surface remaining quota in your response headers

Conventional rate-limited APIs return X-RateLimit-Remaining and X-RateLimit-Reset headers. Read those from the reservation's counters and include them in your response. Clients can self-throttle.

const counter = r.counters[0];
const headers = new Headers();
headers.set("X-RateLimit-Limit", String(counter.quota));
headers.set("X-RateLimit-Remaining", String(counter.remaining));
if (counter.resetsAt) {
  headers.set("X-RateLimit-Reset", counter.resetsAt);
}

Plan-aware limits

Free users get tighter limits than paid users. Implement this by setting different quotas per plan, then assigning each user the right plan via vevee.upsertSubscription. When they upgrade, you change the plan; counters and rules adjust automatically.

Stacking short and long windows

You can have a "60 requests / minute" anti-abuse limit AND a "1000 requests / month" cost cap on the same plan. Both are checked. The user is blocked if either is at quota. Vevee handles the stacking - your code does not need a separate library per window.

Avoiding accidental DoS on yourself

A subtle gotcha: your API endpoint itself may have its own connection-pool or worker limits. Vevee gates AI calls but does not gate ingress. Pair Vevee quotas with a Cloudflare or Vercel rate limit on the ingress to protect your own infrastructure from abuse.

When to use a separate Redis-based rate limiter

For sub-second per-IP anti-DDoS bursts, a Redis-based rate limiter is still faster (lower latency, no network hop to Vevee). The two coexist: ingress rate limit at the edge for 100 req/sec, Vevee quotas for cost-relevant per-user limits.