The latest articles on DEV Community by Sifat Ahmed (@sifat_ahmed_3cc666203e7b8). https://dev.to/sifat_ahmed_3cc666203e7b8 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4090356%2F4ae60a96-0c30-4bc9-82f3-5b62d886acec.png https://dev.to/sifat_ahmed_3cc666203e7b8 en Sifat Ahmed Sun, 23 Aug 2026 02:50:06 +0000 https://dev.to/sifat_ahmed_3cc666203e7b8/why-fusebox-doesnt-support-claude-yet-196f https://dev.to/sifat_ahmed_3cc666203e7b8/why-fusebox-doesnt-support-claude-yet-196f <p>Fusebox emails you before your OpenAI bill blows past a number you set. Before writing any of that code, I spent an afternoon checking one thing: what kind of API key would I actually need to ask people for?</p> <p>That question mattered more than it sounds like it should. A tool that reads your spend needs some credential from your account. The honest version of that credential can <em>only</em> read - it can't touch billing, can't create or revoke other keys, can't add or remove people from your org. The dishonest version asks for more than it needs and hopes you don't check.</p> <h2> OpenAI: genuinely scoped </h2> <p>OpenAI lets you create an Admin key and restrict it to specific permissions per resource - None, Read, or Write. For usage and cost data specifically, that's a scope called <code>api.usage.read</code>. Grant only that, and the key can pull your spend numbers and do nothing else. That's exactly the shape of trust a tool like this should ask for.</p> <h2> Anthropic: not yet, for individual accounts </h2> <p>I checked the same thing for Claude, expecting a similar scoped option. Anthropic's own docs say otherwise, for Claude Console (the product individual developers actually use):</p> <blockquote> <p>"Claude Console keys do not have selectable scopes; every key carries full access to all endpoints that accept Admin API keys."</p> </blockquote> <p>Scoped read-only keys do exist on Anthropic's side (<code>read:spend_limits</code>, <code>read:analytics</code>) but only for <strong>Claude Enterprise</strong> organizations, not individual Console accounts. For everyone else, the only key that can read usage data can also manage your organization's members and revoke other people's API keys.</p> <p>Asking a solo developer to hand that over, in service of a feature as small as "email me at 80% of my budget," is a bad trade. So Fusebox doesn't do it yet. Claude support is built and waiting - it's a small amount of code - but it stays off until Anthropic ships the same kind of scoping for individual accounts that OpenAI already has.</p> <h2> Why this is worth writing down </h2> <p>Most tools that ask for API access don't explain what they're actually asking for, and most users don't check. I'd rather the constraint be visible than quietly worked around.</p> <p>Fusebox is free, early access, OpenAI-only for now: <a href="https://fusebox.sifatsrk.workers.dev" rel="noopener noreferrer">https://fusebox.sifatsrk.workers.dev</a></p> <p>If you've found a cleaner way to do the Claude side of this safely, I'd genuinely like to hear about it in the comments.</p> ai api security buildinpublic