Most people only discover how much a key can spend after it has spent it. A limit should stop the next request, belong to one key, and leave every other app running. Here is what providers offer today, where it falls short, and how to cap each key.
What the providers offer
- OpenAI lets you set a monthly spend limit for each project, and turn it into a hard limit: once it is reached, that project's requests are refused. It covers a whole project, not one key, and OpenAI says it is enforced with some delay.
- Anthropic lets you set a spend limit for each workspace in the Claude Console, below the organization's. Keys belong to one workspace, so the limit covers every key in it.
- Google Cloud budgets send alerts; they do not stop spending by themselves, and billing data can be hours behind. Restrict each API key to the APIs it needs, and set quotas on the Gemini API.
- Stripe has restricted keys, which limit what a key may do, but no cap on how much money a key may move in a day.
Provider settings change often: check the current page in their dashboards.
Where that falls short
- One limit for many keys. When one app or one person leaks a key, the whole project hits the limit, and every app that shares it stops.
- Limits that arrive late. A limit checked against billing data lets a stolen key keep spending until the numbers catch up.
- Nothing per day. A monthly limit lets a stolen key spend the whole month's budget in one night.
- Nothing for money moved. Payment keys can charge, refund and pay out without an amount limit.
A limit on each key, checked on every request
Vallkey checks every request before it reaches the provider. Each app, person or AI agent gets its own ghost key in place of the real key, with its own limits:
- AI budgets per day and per month, estimated from each provider's prices and the tokens each answer used, plus a daily token limit.
- Payment limits: the largest single amount, and how much may move per day, in each currency. Refunds can be blocked entirely.
- Requests per minute and per day, and only the endpoints and models your app uses.
When a ghost key reaches its limit, its next request is refused with the reason, and only that key stops. You get an alert at 80% and when it is reached, and you can kill the key in one click if it looks stolen.
{ "allow": [{ "method": "POST", "path": "/v1/chat/completions" }], "allowedModels": ["gpt-5-mini"], "dailyBudget": 2000, // $20.00 a day "monthlyBudget": 20000, // $200.00 a month "ratePerMinute": 60}Set the same rules in the dashboard without writing any of this. See spending limits in the docs, or protect your first key in five minutes. Already leaked one? Here is what to do now.