Automatic scaling concern

[JeffML]

Lambda functions have a publicly accessible URL-based invocation. While I’ve put some restrictions on access through HTTP headers, I worry still that a malicious actor could drive up my request counts so that I get charged lots of $$$. What’s to prevent this? I don’t want to jump to the next plan level automatically.

[coelmay]

Hey @JeffML

Check out this Support Guide

[Support Guide]: How to apply Access Control for Netlify Functions?

Last checked by Netlify Support Team: July 2025 Introduction: That is a great question, we do get it from time to time. But the answer is not that straightforward. First, there are 2 ways someone might think this works: Can I save my Function invocation count by restricting the function to be called only from my frontend? The answer to that is no. Unfortunately, it just won’t work. No matter what you do, the moment you deploy a Netlify Function, its endpoint is accessible to everyone and it …