2026-10-26: 7 API complaints we heard today

Complaints that English-speaking developers posted publicly between Oct 24 and Oct 26, 2026, paraphrased below with links to the original posts. Each answer uses only what PoYo's public site and docs say today, and links to the page it comes from. Where the docs don't cover something, we say so.

---

Q1. Another SaaS got hacked — and my AI API keys went with it.

What developers are complaining about: A well-known SaaS breach left AI API keys leaked en masse and used for fraudulent traffic. Separately, people reported an OpenAI API key leak tied to Railway, and one developer got an OpenAI email about a leaked key that wasn't even his. Frontend mistakes keep making it worse: exposed API keys in the browser remain a common flaw.

How PoYo answers: Rotate first — a leaked secret is still a leaked secret. After that, our docs list controls that limit what a stolen PoYo key can do:

• IP whitelist. Allow only your approved server IPs on a key, so a key copied out of an env var does not work from the attacker's machine. See the API key page and Getting Started.
• Per-key usage caps (hourly, daily, and total), so one key has a hard ceiling before you notice.
• Per-end-user blocking. Send an X-End-User-ID header and you can block one abusive caller on a key without rotating it. A blocked ID returns HTTP 403 with end_user_blocked. See End-user identification.

Our public docs don't promise refunds for usage made with a leaked key. If you think a PoYo key was misused, revoke it and contact support ([email protected]).

---

Q2. When my model vendor ships the app I compete with, my rate limit is the first thing that gives.

What developers are complaining about: One builder put it bluntly: if your API vendor also ships the product you compete with, the rate limit is the first thing that gives. Reddit threads keep asking the same operational question — how people deal with Claude API rate limits in production and what approaches work for AI provider rate limits.

How PoYo answers: Our error codes page gives each status one meaning and one recommended action:

Getting Started publishes the default generation limit: up to 20 new generation requests per 10 seconds, per account. Requests over that limit get HTTP 429 and do not enter the queue. Chat and media models share one PoYo key and are listed in llms.txt, so switching models is a model string change — not a new vendor onboarding. If you consistently hit 429s, the docs say you may contact support for a higher limit; approvals are handled cautiously.

The docs describe no automatic failover between providers. Build fallback into your client. Getting Started also says PoYo's "overall stability may be slightly lower than official providers."

---

Q3. My "429" was actually a spend limit — billing errors wearing rate-limit clothes.

What developers are complaining about: OpenAI hard spend caps can surface as 429 with project_spend_limit_exceeded / organization_spend_limit_exceeded, so teams treat a billing stop like a throttle. On video APIs, one developer noted that 402 means not enough quota to reserve the charge, while 409 is the idempotency case. Another reminder was practical: set a spending limit so a loop — or a stranger with curl — bills you the same either way.

How PoYo answers: PoYo separates the two cases clearly in the error codes table:

Billing itself is prepaid credits: the homepage says one-time purchases with no recurring subscriptions, and credits never expire. Poll GET /api/user/balance for credits_amount when you need a live number (user balance).

---

Q4. I can't see which model ate the budget across OpenAI, Anthropic, and OpenRouter.

What developers are complaining about: One developer asked whether an OpenRouter spend spike breaks down per model. Others pointed at tooling like View Spend for OpenAI / Anthropic / xAI, while enterprise gossip kept reminding people that Replit moved $100M+ of AI spend from Anthropic to OpenAI for a discount — different vendors, different invoices, same blind spot.

How PoYo answers: Three documented pieces fit this complaint:

1. One key, one balance. Chat and media share one PoYo account. Poll GET /api/user/balance for credits_amount (user balance).
2. Per-key hourly, daily, and total caps on the API key page, so one agent or one environment cannot drain the whole account (Getting Started).
3. Task history + published prices. Inspect model, inputs, and status on the task history surface described in Getting Started. Compare chat and media prices on the pricing page, and read current per-model prices from llms.txt or each model's llms.txt.

---

Q5. My "server function" is callable by anyone — and the key lives where curl can find it.

What developers are complaining about: The same spending-limit post also warned that a server function callable by anyone needs a per-user rate limit and a spending limit. Another post was blunt: don't put an OpenAI key in browser chat templates. And the classic still lands: no .env in GitHub.

How PoYo answers: Getting Started is explicit: never expose your API key in frontend code (browser, mobile apps, public repositories). Treat the key as a secret, keep it on your server, and use the controls already documented for production keys:

• IP whitelist and per-key hourly / daily / total caps on the API key page.
• Require X-End-User-ID, then block an abusive caller with HTTP 403 end_user_blocked without rotating the whole key (End-user identification).

---

Q6. Video APIs burn credits by the second — and the usage UI still looks like tokens.

What developers are complaining about: Video billing keeps confusing people who grew up on token meters. Older but still-cited threads cover API usage UIs that don't match how video is billed and Sora API extension updates with confusing rebilling. The theme is current: video 402s when there isn't enough quota to reserve the charge.

How PoYo answers: Sora 2 Official (and related video models) sit on the PoYo catalog via llms.txt and the AI Video API page. Billing rules that the public pages actually state:

• Credits per successful output, priced per model (llms.txt).
• Failed tasks are not charged (homepage + llms.txt).
• Current prices live on each model page / https://poyo.ai/models/<model-id>/llms.txt — check those before you submit paid work; don't infer dollar amounts from memory.
• Generation is async: POST /api/generate/submit, then poll status or set callback_url (Getting Started). When credits aren't enough, you get 402 insufficient_credits_error (error codes).

---

Q7. Every bot builder learns the API is the real product manager — rate limits write the roadmap.

What developers are complaining about: One post summed it up: every bot builder learns the API is the real product manager; the rate limit is writing the roadmap. Agentic startups keep praying the API doesn't rate-limit mid-demo. Others openly shop for failover on 429 / 5xx.

How PoYo answers: Generation on PoYo is designed to be asynchronous, so long jobs are not tied to a single gateway timeout. Getting Started and the API overview say: submit a task, save the task_id, then poll status or receive a webhook. For production workloads, the docs prefer signed webhooks over frequent polling. On 429, wait or queue (error codes); the default gen limit remains 20 new requests / 10s per account, with overage rejected and not queued. Image, video, music, chat, and 3D sit behind one unified API key (llms.txt, homepage). If you need higher limits, contact support — approvals are handled cautiously.

The docs describe no automatic failover between providers. Your client must handle 429 / 5xx and choose the next model or retry path.

---

Quick map