Abuse protection
fetch.li is a small box. The free demo is easy to try and easy to knock over if we are naive about it. These rails exist so a scanner, a retry loop, or a botnet cannot bill us into the ground or starve paying keys.
Layers
- Edge: Caddy caps request bodies at 32 KB and times out slow clients.
- Shield: method allowlist, oversized URL/UA, honeypot paths, IP bans, scanner user-agents.
- Demo geo: the free demo is refused from networks that routinely source automated abuse. A paid key still works unless we have turned on paid geo-block (off by default).
- Fair queues: burst, per-minute, per-hour, per-IP concurrency, and a global demo shed (HTTP 503) so paid traffic keeps a lane.
- Keys: Unkey verify, local revoke list, separate vibe caps, optional TOTP. See Account and keys.
- Queries: length limits, no control characters, numeric bounds, upstream timeouts and size caps.
- Login: dedicated burst / minute / hour windows, dummy password verify, hashed-email lockout, ban after repeated failures.
- Identity: IPv6 demo and ban buckets use a /64 so one allocated block cannot mint unlimited quota.
Demo vs paid
| Demo (no key) | Paid key | |
|---|---|---|
| Burst | Low | Higher |
| Hourly | 60, or 12 on strict networks | Plan + Unkey |
| Vibe classify | No | Yes, extra cap |
| Honeypot / scanners | Ban | Ban |
| High-abuse demo geos | 403 | Allowed |
If you are a legitimate UK or EU user on a VPN exit that we treat as high-risk, turn the VPN off or get a key. Email hello@fetch.li with your request id if you think we got it wrong.
Honeypots
Paths such as /.env, /wp-login.php, and /v1/admin are not real products. Hitting them returns a normal 404 and bans the network for a day. Do not scan this host.
429 and 503
- 429
rate_limited: you personally went too fast. HonourRetry-After. - 503 on demo: the shared free lane is saturated. Wait, or use a key. We shed demo first so Starter/Pro/Business keep working.
Repeated 429s from the same network become a temporary ban. That is how a stuck cron is supposed to fail: loudly, not by melting the box.
See also Demo tier and Errors.
/v1/password
GET /v1/password still mints a short word passphrase. It is deprecated. Responses include Deprecation: true and Sunset: Sun, 13 Dec 2026 00:00:00 GMT. Member login passwords on /v1/auth are unrelated. The MCP tool stays until that sunset, then the route is removed.