Built-in protection
Every Submito endpoint includes built-in spam protection — no configuration needed.API key required
Every submission must include a valid API key — anonymous abuse is blocked by default.
Quota enforcement
Monthly quotas act as a natural cap against large-scale abuse.
Duplicate request protection
Concurrent duplicate requests from the same API key are blocked automatically.
Payload size limit
Non-JSON request bodies over 64KB are rejected before processing.
What gets blocked
- Requests without a valid API key →
401 - Requests with a revoked API key →
403 - Requests after monthly quota is exceeded →
429 - Non-JSON payloads over 64KB →
413 - Malformed or empty request bodies →
400 - Concurrent duplicate requests →
409
Tips for reducing spam
- Don’t expose your endpoint URL publicly if possible — use a backend proxy
- Add client-side validation to catch obviously invalid submissions before they’re sent
- Use honeypot fields — add a hidden input that humans won’t fill but bots will:
_.