The latest articles on DEV Community by KeyBark (@keybark). https://dev.to/keybark https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4217002%2F19a5383c-41dd-4933-8d15-906089e073f3.png https://dev.to/keybark en KeyBark Fri, 30 Oct 2026 10:32:16 +0000 https://dev.to/keybark/your-ai-api-spend-limit-might-not-stop-anything-a-10-minute-check-for-openai-anthropic-and-744 https://dev.to/keybark/your-ai-api-spend-limit-might-not-stop-anything-a-10-minute-check-for-openai-anthropic-and-744 <p>A leaked or looping API key keeps billing until something actually blocks it. This month's OpenCode Console breach showed how many of us assumed a provider "limit" would do that, and found out it didn't. Here's a quick check, straight from the providers' own docs.</p> <h2> OpenAI </h2> <ul> <li> <strong>A limit only blocks traffic if "Enforce a hard limit" is on.</strong> Spend alerts only notify. With enforcement on, requests get a <code>429</code> with <code>organization_spend_limit_exceeded</code> or <code>project_spend_limit_exceeded</code>. Enforcement isn't immediate, so spend can go slightly past the cap. (<a href="https://developers.openai.com/api/docs/guides/spend-limits" rel="noopener noreferrer">OpenAI spend limits</a>)</li> <li> <strong>Give each project that runs agents its own hard limit</strong>, so one runaway project can't eat the whole org budget.</li> <li> <strong>Use project-scoped keys with an expiry date</strong>, and rotate them. OpenAI also says never to ship a key to a browser or mobile app. (<a href="https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety" rel="noopener noreferrer">OpenAI key safety</a>)</li> </ul> <h2> Anthropic </h2> <ul> <li> <strong>You can't set a spend limit on the Default Workspace.</strong> Only the organization limit applies there. Create a separate workspace, give it a monthly limit, and move production keys into it. (<a href="https://platform.claude.com/docs/en/manage-claude/workspaces" rel="noopener noreferrer">Anthropic workspaces</a>)</li> <li> <strong>Expect usage data to lag a little</strong>, so don't rely on a check that runs once a day.</li> </ul> <h2> OpenRouter </h2> <ul> <li> <strong>Set a per-key credit limit</strong> with a reset (<code>daily</code>, <code>weekly</code> or <code>monthly</code>). <code>GET https://openrouter.ai/api/v1/key</code> shows <code>limit_remaining</code>. (<a href="https://openrouter.ai/docs/api/api-reference/api-keys/create-a-new-api-key" rel="noopener noreferrer">OpenRouter keys</a>)</li> </ul> <h2> Every provider </h2> <ul> <li>Keep keys out of frontend code and public repos, including git history.</li> <li>Give agents a max-steps, max-tokens or timeout guard. Retries in a loop are the most common surprise bill.</li> <li>Have something other than your laptop watching spend overnight.</li> </ul> <h2> A shortcut </h2> <p>Disclosure: I built KeyBark. Its free <a href="https://keybark.com/limit-audit?utm_source=devto&amp;utm_medium=article&amp;utm_campaign=w1&amp;utm_content=spend-limit-check" rel="noopener noreferrer">limit audit</a> walks through the checks above as yes/no questions (runs in your browser, no sign-up, no key) and lists what to fix. KeyBark itself is a hosted watcher that emails you when spend crosses a threshold (free for one key), but you don't need it to do anything in this post.</p> openai ai security devops