Cap your AI API bill before you make the first call
An API key is a credit card number that software can use at 3 a.m. Five steps to set a spending ceiling and keep the key out of places strangers can read, before your first test request.
Updated 2026-11-08 · Sources checked 2026-11-08 · The Loaded Tokens desk
An API key is the secret string your code sends with each request so the provider knows who to bill. Make a new key for this project instead of reusing an old one. OpenAI's key-safety guide says project keys can carry an expiration date, after which requests with that key are rejected. Set one.
OpenAI's key-safety guide says to set monthly spend limits with hard enforcement, because spend alerts alone don't stop traffic. Its spend-limits guide gives the path: Organization limits (or a project's settings, then Limits), Edit spend limit, enter a monthly amount, and turn on Enforce a hard limit. In Anthropic's Claude Console, the Billing page has a Spend limits section with an Adjust limit or Set limit button. Pick a small number for a first test.
Check: You can name the monthly limit, and it is lower than what a surprise bill would hurt.
Both providers' docs say that once you hit a limit you set, requests fail with an error until you raise or remove the limit, or the next month begins. OpenAI warns that hard enforcement can block legitimate requests and that spend may slightly exceed the limit, because enforcement isn't instantaneous. Plan for your app to stop, not to keep billing.
Store the key in an environment variable, which is a setting on your computer or server that your code reads at run time, such as OPENAI_API_KEY. OpenAI's guide says never to commit a key to a repository and never to ship it in a browser or mobile app, because anyone who can see the app's code can take the key and run up charges on your account.
Run one small request, then open the provider's usage page and confirm the charge landed where you expected. If anything looks off, rotate the key, meaning create a replacement and revoke the old one. Once the old key is revoked, a leaked copy stops working.
Questions
Do I still need a spend limit if I'm only testing on my laptop?
Yes. A loop that retries forever runs just as fast on a laptop as on a server, and a key copied from a test script spends the same money as a production key.
Is a spend alert enough?
An alert tells you about the problem after it starts. OpenAI's own guide says alerts alone don't stop API traffic, which is why the hard limit matters.
Sources
Every product fact above comes from one of these pages. We did not run a separate test for this guide.