NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
AI API Rate Limiting, Auth and Abuse Testing
Master the infrastructure security of LLM APIs. Learn to exploit and defend against token exhaustion, API key leakage, and automated abuse in agentic workflows.
Room tasks
1What Makes AI API Abuse Different from Normal API Abuse
2Testing Rate Limits and Cost-Based Denial of Service
3Testing Authentication and Authorization on AI Endpoints
Frequently Asked Questions
What is a denial of wallet attack?
It is an attack that drives up the victim's pay-per-token or usage costs by sending expensive requests, rather than taking the service offline. LLM APIs are prime targets because each call costs money.
How should LLM APIs be rate limited?
Limit by user, key and token consumption, not just request count, and cap prompt and output sizes. Add budgets and alerts so abusive usage is blocked before costs or availability suffer.
How do API keys leak in AI apps?
Keys often end up hardcoded in client code, public repositories or logs. Use secret managers, scope and rotate keys, and proxy calls server side. This room covers testing for all of this, free.