API drain is the abusive use of an application programming interface to consume quotas, credits, or paid usage without the owner’s permission. Instead of stealing data, the attacker spends someone else’s access by sending requests that trigger billing, exhaust rate limits, or burn through prepaid service credits.
This matters because many cloud, AI, and SaaS services charge per request or per token. In real attacks, stolen API keys, compromised accounts, or bot traffic can generate unexpected costs even when no obvious outage occurs. Defenders should monitor request volume, billing spikes, and abnormal geographies or user agents, then restrict keys with least privilege, set quotas and alerts, and rotate or revoke exposed credentials quickly.