Rate limits cap short-window activity, like "10 requests per minute," while quotas cap sustained usage, like "1,000 exports per month." The first protects your server from being overwhelmed right now; the second limits cost and abuse over time.

Modern web apps often trigger expensive work behind the scenes: sending emails, generating PDFs, calling third-party APIs, running AI inference, or processing payments. Quotas simply put a ceiling on that cost.

Good candidates include email sends, SMS messages, AI completions, image generation, and report exports. They're either expensive per unit or abusable at volume... but usually both.

Checking the quota and incrementing usage must be atomic. If you read first and write later, concurrent requests can all spend the same last remaining unit.

Assignment

The warehouse integration can use its API key without a long-term ceiling.

Enforce the prebuilt daily quota.

In src/routes/api.ts, import the following helpers from "./apiKeyQuota.ts":
- sendApiKeyQuotaExhausted
- setApiKeyQuotaHeaders
- toApiKeyQuotaResponse
Import consumeApiKeyQuota from "../auth/apiKeyUsage.ts".
Update the GET /api/integrations/warehouse/orders handler:
1. Consume the quota after the API key and scope are validated.
2. Handle whether the quota is exhausted.
3. Otherwise set the quota headers.
Add toApiKeyQuotaResponse(quota) under quota in the successful JSON response.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.