[akennberg]

You can add a soft rate limit with a captcha to make sure it's a human doing the requests rather than a spammer's script.

[dangrossman]

You can't rate limit APIs with CAPTCHAs.