2026-10-22: 7 API complaints we heard today

Complaints that English-speaking developers posted publicly between Oct 20 and Oct 22, 2026, paraphrased below with links to the original posts. Each answer uses only what PoYo's public site and docs say today, and links to the page it comes from. Where the docs don't cover something, we say so.

---

Q1. My AI keys were sitting in my host's environment variables, and someone drained them overnight.

What developers are complaining about: Railway disclosed on Oct 21 that an unauthorized party may have read decrypted environment variables, and it told every user to rotate keys stored there. Within hours, one developer said someone spent $500 on his OpenAI key, another said his OpenAI balance was fully used up, and a third said Anthropic emailed to say keys stored in Railway had been disabled. The same night, a security account reported that LiteLLM 1.107.0 was briefly shipped with a credential stealer. The Hacker News thread kept asking the same question: if a key leaks, who pays the bill?

How PoYo answers: A leaked secret is still a leaked secret, so rotate first. But our docs list controls that limit what a stolen PoYo key can do:

• IP whitelist. You can allow only your approved server IPs to use a key, so a key copied out of an env var doesn't work from the attacker's machine. See the API key page and Getting Started.
• Per-key usage caps (hourly, daily, and total), which put a ceiling on how much one key can spend before you notice.
• Per-end-user blocking. Send an X-End-User-ID header and you can block one abusive caller on a key without rotating it. See End-user identification.

Our public docs don't promise refunds for usage made with a leaked key. If you think a PoYo key was misused, revoke it and contact support ([email protected]).

---

Q2. One click in my app turned into nine API calls while the provider was overloaded.

What developers are complaining about: One developer pointed out that the Anthropic SDK already retries failed requests twice by default, on 408, 409, 429, and 5xx errors. Wrap that in your own three-attempt loop, and a single click can send nine requests to an API that is asking you to slow down. Another developer said the newly released Sonnet 5.5 still hit 529 errors at times.

How PoYo answers: Our error codes page gives each status one meaning and one recommended action, which makes it easier to decide where retries belong:

Two more documented rules matter here. Getting Started says requests over the rate limit are rejected with 429 and don't enter the queue, so extra retries only add more rejections. It also says to treat every resubmission as potentially new paid work and to check whether the original request already created a task before you retry. For media generation, llms.txt states that failed tasks are not charged.

If you want Sonnet 5.5 itself, Claude Sonnet 5.5 is listed at $1.60 input / $8.00 output per 1M tokens, which the model page describes as 20% below official standard rates.

---

Q3. I left an agent running overnight and woke up to a four-figure bill.

What developers are complaining about: One developer said he accidentally left two coding-agent sessions running overnight and spent over $2,000, and was only saved because his card declined. On the company side, a weekly roundup noted that Accenture capped Claude at $29 a month per employee after some staff spent $500 to $1,000.

How PoYo answers: Here's what our docs give you to stop runaway spend:

• Prepaid credits, no subscriptions. The PoYo homepage describes one-time credit purchases with no recurring subscriptions. When the balance runs out, requests get a 402 insufficient_credits_error (error codes) instead of piling up a bill.
• Hourly, daily, and total caps on each key. Give each tool, teammate, or agent its own key with its own cap, so one forgotten terminal can't drain the whole account (Getting Started).
• Balance you can poll. GET /api/user/balance returns credits_amount in real time (user balance), so you can alert yourself before you hit zero.

---

Q4. I can't plan around usage limits nobody will tell me.

What developers are complaining about: One recap of OpenAI's recent stretch noted that about 40,000 Codex accounts got the wrong usage limits. A widely read post complained that the big agent products don't tell you the limits. Another developer posted a screenshot of an "out of usage" message that just said the rate limit "resets on 6:28 PM", and a separate write-up tried to document what nine AI services don't say about their free plans.

How PoYo answers: Our default limit is written down in Getting Started: up to 20 new generation requests per 10 seconds, per account, which "typically allows 100+ concurrent running tasks." Requests over that limit get HTTP 429 and are not queued. If you hit 429s consistently, the same page says you can ask support for a higher limit, though approvals are cautious. Generation is asynchronous, so a long-running job doesn't hold a slot in that 10-second window once it's submitted (API overview).

---

Q5. One provider has a bad day, and my whole product goes down with it.

What developers are complaining about: OpenAI's status page showed a partial outage with elevated API error rates on Oct 21, and one developer summed up the week as OpenCode, Railway, and a Google Cloud outage all at once. A builder argued that if your agent relies on a single provider, you're "one rate limit, price hike, or API outage away from complete downtime."

How PoYo answers: Here's what the docs support, and what they don't:

• One key, many model families. Claude, GPT, Gemini, DeepSeek, and the media models all run on the same PoYo key, so switching to another model means changing the model value, not starting a new integration. Every model is listed in llms.txt.
• Distinct upstream errors. The error codes page separates 502 upstream_error from 503 service_error, so your fallback logic can tell them apart.
• What we don't claim. The docs describe no automatic failover between providers, so build fallback into your client. Getting Started also says directly that PoYo's "overall stability may be slightly lower than official providers." We'd rather say that up front.

---

Q6. One 1080p video ate all my credits.

What developers are complaining about: One creator said she used up her Seedance 2.5 credits on a single 20-second 1080p video and called the cost insane. A widely bookmarked AI filmmaking thread told people to ask, before paying anything, "How many credits will revisions actually cost?"

How PoYo answers: Each video model publishes per-second prices, so you can price a clip before you submit it:

• Seedance 2.5 lists 480p at $0.140/s and 1080p at $0.570/s without video input, with lower per-second rates when the request includes a reference video. At the listed rate, a 20-second 1080p clip without video input works out to $11.40.
• Kling 3.0 lists 720p without audio at $0.135/s and 1080p with audio at $0.245/s.

Iterating at 480p and rendering the final cut at 1080p is the cheapest path those prices allow. All video models use the same async submit-and-status flow and are collected on the AI Video API page. Failed tasks are not charged (llms.txt), but a clip that finishes and that you don't like still counts as a successful output and is billed.

---

Q7. I got charged for a renewal on credits I never used.

What developers are complaining about: One user said a video platform charged him $49 for a subscription renewal even though he hadn't used a single credit, and support answered his refund request by quoting the terms of service. A review of another video suite flagged its plan as 2,000 credits a month with no rollover.

How PoYo answers: The PoYo homepage says plainly: one-time purchases with no recurring subscriptions, and credits never expire. There's no renewal to forget about and no monthly reset. You can check what's left at any time with the user balance endpoint, and compare per-model prices on the pricing page.

Our public docs don't state a refund policy for purchased credits, so we won't make one up here. Questions go to [email protected].

---

Quick map