Guide · for developers
How to stop an AI agent looping on your API
An agent that hits an error it does not understand often retries the same call, again and again, for as long as it runs. Each call is small, so nothing alarms, but your database, your API bill and your logs fill up. Here is how to stop it.
Why it happens
Agents built with Claude Code, Cursor or an agent framework recover from failures by trying again. When the failure is permanent (a schema change, a missing record, a 400 they misread), trying again never works, and the agent can keep going until it runs out of turns or budget.
Why rate limits miss it
A rate limit counts calls per minute. A looping agent can stay under it: three identical calls a second is well inside a normal limit, and it is still 10,000 useless calls an hour. What gives a loop away is not volume but repetition: the same method, path, query and body, over and over, at a machine-steady pace.
Stop it in your code
- Cap retries per call (three is plenty) and back off between them (1 s, 2 s, 4 s).
- Do not retry 4xx answers except 408 and 429; they will not change.
- Give writes an idempotency key so a repeated POST cannot create a second order.
- Give every agent run a budget (calls or time) it cannot exceed.
Stop it at the gateway
Code fixes only help code you control. An agent someone else wrote, or one that ignores its limits, still reaches your API. A gateway in front of the API catches it no matter who wrote it. Odile Gate does this on its free tier: each app gets its own key and an allow-list of the calls it may make, and the loop breaker stops an app that keeps sending the same call before the call reaches your API or uses your quota. The stopped call gets 429 with x-odile-gate-loop-detected: true, your webhook gets one message at once, and you can make it stricter or looser for each app.
Set it up in three calls
curl -X POST https://gate.odilelabs.com/api/projects -H "content-type: application/json" \
-d '{"name":"Shop API","upstream":"https://api.example.com/v1","header_name":"Authorization","header_value":"Bearer ..."}'
curl -X POST https://gate.odilelabs.com/api/projects/<project-id>/apps \
-H "Authorization: Bearer <admin key>" -H "content-type: application/json" \
-d '{"name":"claude-agent","routes":["GET /orders/:id","POST /orders"],"per_minute":60}'
curl "https://gate.odilelabs.com/g/<project-id>/orders/42" -H "Authorization: Bearer <app key>"
Point the agent at the Gate address instead of your API, with its own key. Your real API key stays inside Gate, encrypted.
Free: 3 apps, 10,000 calls a month. Pro: $29 a month, 25 apps, 1,000,000 calls a month.