Fixes › Env vars & leaked keys

OpenAI 429 'You exceeded your current quota' or a surprise AI bill

CursorReplitBoltLovable

The error

429: You exceeded your current quota, please check your plan and billing details

Why it happens

Either the account has no credit or hit its spend limit, or something is calling the API far more than expected: a re-render loop, no rate limiting on your /api route, or a leaked key being used by someone else.

How to fix it

1. Check usage in the provider dashboard; if it's unexplained, revoke the key.
2. Set a monthly budget/limit in the provider's billing settings.
3. Add auth and per-user rate limiting to the server route that calls the AI API.
4. Retry 429s with exponential backoff, and cache repeated prompts.

Fix prompt (paste into Lovable, Bolt, Cursor, Replit or v0)

We're getting OpenAI 429 quota errors and unexpectedly high usage. Make sure the key is only used server-side, add authentication and per-user rate limiting to the route that calls OpenAI, add exponential-backoff retries for 429s, cap max tokens, and log request counts per user (no prompt contents).

FAQ

Does 429 always mean rate limiting?

'Exceeded your current quota' is about billing or limits; 'rate limit reached' is about speed.

Should I set a budget?

Yes, set a hard limit in billing settings.

Related fixes

• Supabase service_role key exposed in frontend code
• OpenAI / Stripe secret key leaked in the browser
• Environment variable is undefined in production
• .env file committed to GitHub