No cap on LLM API spend in Next.js

const DAILY_LIMIT = 20;

export async function POST(request: Request) {
  const user = await getCurrentUser();
  if (!user) return new Response("Unauthorized", { status: 401 });

  const used = await countToday(user.id);
  if (used >= DAILY_LIMIT) return new Response("Daily limit reached", { status: 429 });

  await incrementToday(user.id);
  // call the provider with a max output token setting you chose
}

Pick DAILY_LIMIT by dividing what you can afford by how many users you might have, not by copying 20. Increment before the call so a crash still counts, or decrement if you prefer to count only successes. Either way, store the count in the database, not in memory on the serverless instance and not in the browser.

Streaming does not change the rule. A stream is still a paid call.