I think the rate limit user was simply not sending the API key correctly or having some very poor code, you get 100 request for 100 seconds for each user, you j

I think the rate limit user was simply not sending the API key correctly or having some very poor code, you get 100 request for 100 seconds for each user, you just need to use the token of the user not yours. As for the horror stories that's with everything you could argue that Stripe is a horrible idea because Visa could block them, but I do see your idea here, I'm planning to add some "spreadsheet features" directly in the app to avoid being completely dependent on them