[bestcoder69]

Same. I’d be more worried about an API with no rate limit. Say if another customer ships a bug that DoS’s the API on accident.

[clukic]

I would think a user token level limit would prevent this, although I could imagine a case where a bug simultaneous affected all user tokens, but I'd imagine you'd set that app level limit pretty high because otherwise you'd be making life very difficult for legitimate use cases.