AI APIsRate limits

OpenAI / LLM API: 429 Too Many Requests or insufficient_quota

429: You exceeded your current quota, please check your plan and billing details.

In short: Either you're sending requests too fast, or the account has no credit left. Same status code, different fixes.

Why it happens

LLM APIs return HTTP 429 for both rate limits (too many requests or tokens per minute) and exhausted quota. Read the error body: insufficient_quota means billing, while rate_limit_exceeded means slow down. Loops in vibe-coded apps (a useEffect that refetches on every render, retries with no delay) can burn through limits in seconds.

How to fix it

1. Read the full error body to see which kind of 429 it is.
2. Quota: add credit or a payment method in the provider's billing page. New keys on new projects may need billing set up first.
3. Rate limit: add retries with exponential backoff and jitter, honoring the retry-after header if present.
4. Check for runaway loops: log every API call with a timestamp. Fix useEffect dependency arrays and debounce user input.
5. Cache repeated identical requests and limit max_tokens/output length.
6. Add per-user rate limiting on your own endpoint so one visitor can't drain your quota.

Copy-paste fix prompt

I'm getting this error in my app:

429: You exceeded your current quota, please check your plan and billing details.

[Paste the full error, stack trace, and the file it points to here]

Likely cause: Either you're sending requests too fast, or the account has no credit left. Same status code, different fixes.

Task: Find every place this app calls the LLM API. Check for loops or repeated calls, add exponential backoff with jitter on 429s, and add a simple per-user rate limit on my server endpoint. Tell me if the error indicates billing instead.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, Replit, Bolt, Claude Code. Last reviewed 2026-11-13.