diff --git a/app/main.py b/app/main.py
index 050d580..317a086 100644
--- a/app/main.py
+++ b/app/main.py
@@ -1580,6 +1580,7 @@ async def list_models(request: Request):
 
 
 @app.api_route("/v1/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
+@limiter.limit("120/minute")
 async def inject_key(request: Request, path: str):
     """Read the member's email from a header, inject their key, forward to LiteLLM."""
     # Verify the request came through the chat frontend, so a direct caller