How can I safely offer a few free API-powered previews without getting abused?

If the previews are valuable enough to abuse, requiring a verified email or a simple account after the free attempts is stronger than relying on cookies. I understand wanting to avoid registration for this audience, though, so I’d start with cookie-based limits, a soft IP limit, bot protection, and a strict global budget cap. Watch the usage logs for a while and only add sign-in or phone verification if real abuse appears.

Put a bot challenge such as Turnstile or another CAPTCHA alternative directly on the preview-generation endpoint, not necessarily on every page view. You can require it after the first preview or when traffic looks suspicious. Adding a short delay or queue for each generation can also make automated abuse much less attractive without noticeably hurting normal customers.

IP limiting is fine as one signal, but it shouldn’t be the only one. Shared networks and mobile carriers can put many legitimate visitors behind one IP, while someone determined can rotate IPs with a VPN. For a no-login flow, issue a random server-side token stored in a cookie and combine it with IP, user-agent, and request timing. This will stop casual repeat use, though nothing anonymous will stop a determined attacker completely.

Make a hard spending and request limit on your backend the most important safety measure. Track all preview requests globally, set a daily cap for free usage, and configure a spending limit with the API provider if available. That way, even if someone bypasses your per-visitor controls, the maximum loss is still bounded. You can temporarily disable previews or show a maintenance message once the cap is reached.