diff --git a/terracotta/config.py b/terracotta/config.py
index 4dbcfc3e..ff9cbc00 100644
--- a/terracotta/config.py
+++ b/terracotta/config.py
@@ -92,6 +92,9 @@ class TerracottaSettings(NamedTuple):
     #: Use a process pool for band retrieval in parallel
     USE_MULTIPROCESSING: bool = True
 
+    #: Maximum number of metadata keys per POST /metadata request
+    MAX_POST_METADATA_KEYS: int = 100
+
 
 AVAILABLE_SETTINGS: Tuple[str, ...] = TerracottaSettings._fields
 
diff --git a/terracotta/handlers/metadata.py b/terracotta/handlers/metadata.py
index 6afba6a5..381e936b 100644
--- a/terracotta/handlers/metadata.py
+++ b/terracotta/handlers/metadata.py
@@ -47,7 +47,7 @@ def multiple_metadata(
 
     out = []
     with driver.connect():
-        for dataset in datasets:
+        for dataset in datasets[:settings.MAX_POST_METADATA_KEYS]:
             metadata = filter_metadata(driver.get_metadata(dataset), columns)
             metadata["keys"] = OrderedDict(zip(key_names, dataset))
             out.append(metadata)
diff --git a/tests/server/test_flask_api.py b/tests/server/test_flask_api.py
index 6a216ad2..8e46a139 100644
--- a/tests/server/test_flask_api.py
+++ b/tests/server/test_flask_api.py
@@ -90,6 +90,31 @@ def test_get_metadata_nonexisting(client, use_testdb):
     assert rv.status_code == 404
 
 
+def test_post_metadata(client, use_testdb):
+    rv = client.post(
+        "/metadata",
+        json={
+            "keys": [["val11", "x", "val12"], ["val21", "x", "val22"]]
+        },
+    )
+
+    assert rv.status_code == 200
+    assert len(json.loads(rv.data)) == 2
+
+
+def test_post_metadata_specific_columns(client, use_testdb):
+    rv = client.post(
+        '/metadata?columns=["bounds", "range"]',
+        json={
+            "keys": [["val11", "x", "val12"], ["val21", "x", "val22"]]
+        },
+    )
+
+    assert rv.status_code == 200
+    assert len(json.loads(rv.data)) == 2
+    assert set(json.loads(rv.data)[0].keys()) == {"bounds", "range", "keys"}
+
+
 def test_get_datasets(client, use_testdb):
     rv = client.get("/datasets")
     assert rv.status_code == 200