2026-10-28: 7 API complaints we heard today

Complaints that English-speaking developers posted publicly between Oct 26 and Oct 28, 2026, paraphrased below with links to the original posts. Each answer uses only what PoYo's public site and docs say today, and links to the page it comes from. Where the docs don't cover something, we say so.

---

Q1. Claude Code hit the usage wall mid-refactor — and there is still no clean "fall back to my API key" path.

What developers are complaining about: Oct 27–28 timelines were full of side-by-side Claude Code / Codex usage-limit screenshots. Builders asked whether Claude Code can fall back to an API key once subscription limits are hit (@irl_danB), joked that hitting a limit mid-refactor is the new "forgot to save" (@automater_ai), and compared $20 tiers that feel useless on one stack while another Plus sub never tripwires (@mozdca, @LeoZhang57).

How PoYo answers: PoYo is prepaid credits, not a subscription 5-hour / weekly window. The homepage describes one-time credit purchases, no recurring subscriptions, and credits that never expire. You pay for successful generations; llms.txt states failed tasks are not charged. Chat and media share one API key and one balance — poll GET /api/user/balance for live credits_amount (user balance).

When the balance is gone, PoYo returns 402 insufficient_credits_error, not a rolling usage window dressed as a throttle (error codes). There is no documented "subscription → API key" failover product feature, because billing is already credit-based. Cap a runaway agent with the per-key hourly / daily / total usage limits on the API key page (Getting Started).

---

Q2. Claude Code's "429" is three different messages — waiting forever only helps one of them.

What developers are complaining about: A troubleshooting thread called out that Claude Code can surface three different 429-shaped failures — wait for a reset, retry in a moment, or check the API key — and each needs a different fix (@aiparabellum). Separately, builders asked whether rate-limit issues in Anthropic agent tooling were fixed yet (@XavierDelon, @GeorgeMathew_).

How PoYo answers: Our error codes keep billing and rate limits on different numbers:

Default generation throughput is documented as up to 20 new requests per 10 seconds per account; overage gets HTTP 429 and does not enter the queue (Getting Started). Integration troubleshooting also says: honor Retry-After on rate limits, and do not blindly retry a paid submission until you know whether a task_id was created (troubleshooting).

The docs describe no automatic failover between upstream providers. Build that in your client.

---

Q3. Any API key I ever pasted into the agent chat is still sitting in the project logs.

What developers are complaining about: After a thread about Claude project logs, one reply cut to the risk: any API key you ever pasted into the chat is in those logs too — grep ~/.claude/projects for sk- and rotate whatever turns up (@wazX_7). Nearby posts kept pushing the same hygiene: treat AI keys like root credentials (@RuntimeAI_io), and stop giving every agent one shared key with no kill switch (@RohanBhanotAI).

How PoYo answers: Getting Started is blunt: never expose your API key in frontend code, mobile apps, or public repositories, and treat it as a secret. Keep keys on your server. After a paste or suspected leak:

1. Revoke / rotate the key on the API key page.
2. IP whitelist so a copied key only works from approved server IPs.
3. Per-key hourly / daily / total caps so a leak has a ceiling.
4. Send X-End-User-ID on generation and native chat; block one abusive caller with HTTP 403 end_user_blocked without rotating the whole key (End-user identification).

Our public docs do not promise refunds for usage made with a leaked key. Contact [email protected] if you believe a PoYo key was misused.

---

Q4. My forgotten aggregator key is still an agent wallet — a host breach turned idle credentials into a 500-step job.

What developers are complaining about: A post warned that a forgotten OpenRouter key is still an agent wallet: a Railway-style breach put idle keys on a kill list, and one had already funded a 500-step agent job while dashboards showed zero traffic until then. The fix called out: spend caps, short-lived keys, and no provider tokens on hosts you stopped watching (@neiro_go_neiro). Another reply tied the same pattern to providers still revoking keys weeks after breaches (@Kenz_1604).

How PoYo answers: Idle keys on abandoned hosts are a client-side secret problem; PoYo's documented controls limit blast radius once a secret exists:

• Create separate keys per environment / harness, each with hourly, daily, and total usage caps (API key page, Getting Started).
• Turn on an IP allowlist for production keys.
• Prefer X-End-User-ID so you can block one caller without deleting the key (End-user identification).
• Watch live balance with GET /api/user/balance (user balance) and task history in the dashboard (Getting Started).

Delete keys you no longer use. The docs do not document auto-expiry of unused keys or a refund SLA for breach-driven spend — say so and rotate.

---

Q5. I set a hard AI spend limit — then someone got the key and blew past it overnight.

What developers are complaining about: One builder set a $25 AI bill limit; someone got the API key and ran it to $55 in one night (@twentyonemilll). The theme matches older OpenRouter threads where disable was not enough and only full key deletion stopped the drain — but the Oct 28 window is still producing the same "cap existed, leak still hurt" complaint.

How PoYo answers: Caps only help if they are enforced on the compromised credential, not only on a dashboard soft budget. On PoYo:

• Put per-key hourly / daily / total usage caps on every production key (Getting Started, API key page).
• Combine with IP whitelist so the key fails from the attacker's network.
• Use X-End-User-ID + block for multi-tenant apps (End-user identification).
• On 402, stop — that means credits are gone (error codes). Poll balance before large batches (user balance).

If a key may be out, delete/revoke it, don't only lower a soft alert. Public docs do not claim refunds for leaked-key spend.

---

Q6. Getting a Google API key is so painful that "just use an aggregator" became the default.

What developers are complaining about: A developer said they will only try Google models if the API-key signup process is fixed — until then it is OpenRouter only (@sandipb). Nearby posts kept framing aggregators as the payment wallet / model switch for agents (@tomcritchlow), while others still juggle a dozen vendor keys just to test (@sunwei57247249).

How PoYo answers: PoYo is built as one unified key across image, video, music, 3D, and chat (llms.txt, homepage). Create a key at the API key page; media uses async POST /api/generate/submit + status/webhook; chat uses OpenAI-compatible, Claude Messages, or Gemini-native endpoints as documented per model. Switching models is a model string (and the matching endpoint shape for chat) — not a new vendor onboarding flow.

Current input schemas and prices live at https://poyo.ai/models/<id>/llms.txt and in the catalog index (llms.txt). The docs do not claim PoYo is a passthrough of each lab's official account; they also say overall stability may be slightly lower than official providers (Getting Started). Pick the trade-off consciously.

---

Q7. A $59 video subscription is the expensive way in if I only ship a few clips — and retries can invent a second bill.

What developers are complaining about: Creators compared monthly video-tool plans to pay-per-clip APIs: if you only make a few AI videos a month, a $59 plan can be the expensive path, while an API bills per clip and coding agents can drive it (@aliteqai). Related API pain: completed video downloads gated on billing settlement (@MariaOnchainDev), and the standing fear that blind retries create a second charged job.

How PoYo answers: Video on PoYo is credit-priced per successful output, model by model — browse the video catalog in llms.txt (Sora 2, Veo 3.1, Kling, Wan, Seedance, Hailuo, and more). Workflow is the unified async API: submit → poll status or set callback_url (Getting Started, webhooks). Homepage and llms.txt both state failed tasks are not charged.

Before you hammer retry on a slow video job: Getting Started warns that every submission retry may be new paid work — confirm whether the original request already created a task_id. Prefer webhooks over aggressive polling. On 402 vs 429 vs 5xx, follow the error codes table; do not treat a credit stop like a rate limit.

---

Quick map