Answers · agent payments
How do I give each AI agent its own budget when they call paid APIs?
Last updated
TL;DR: Give every agent its own key, and put the cap on that key or on the project or workspace the key belongs to, not on the whole account. OpenAI caps spend per project: make one project per agent, use that project's keys, and set a monthly spend limit with Enforce a hard limit turned on (requests then fail with 429 project_spend_limit_exceeded). In the Claude Console, put each agent in its own workspace and set a monthly workspace spend limit (not available on the Default Workspace, and never above the organization's limit). OpenRouter caps each API key directly, with a daily, weekly or monthly reset (requests fail with 403 Key limit exceeded). Keep a lower organization-wide limit above all of them, and remember that provider caps are monthly or daily and not instantaneous, so a runaway agent can still spend real money before it stops.
What should I check, step by step?
1. Never let two agents share a key. A shared key makes per-agent caps and per-agent cost reports impossible, and revoking it stops every agent at once.
- OpenAI: create a project per agent (or per agent team), issue that agent's keys inside it, then in Project settings > Limits set a Monthly spend limit and turn on Enforce a hard limit. Without that switch, the limit only monitors spend and requests keep going.
- OpenAI by API: an Admin API key can set the same cap with POST /v1/organization/projects/{project_id}/spend_limit, where threshold_amount is in cents and only USD and a monthly interval are supported.
- Claude: create a workspace per agent and set its Spend limits on the Workspaces page. You can't set a spend limit on the Default Workspace, so don't run agents there, and per-workspace rate limits are a second brake.
- OpenRouter: give each agent key its own limit and limit_reset (daily, weekly or monthly, resetting at midnight UTC). If the agent uses your own provider keys through OpenRouter (BYOK), set include_byok_in_limit to true, or that spend never counts toward the cap.
- Keep an organization-level cap set lower than the sum you could tolerate losing. Per-agent caps stop one agent; the organization cap stops a mistake that creates many agents.
- Handle the refusal in code: treat 429 project_spend_limit_exceeded (OpenAI) or 403 Key limit exceeded (OpenRouter) as a stop-and-tell-a-human signal, not an error to retry.
- For paid APIs that have no per-key budget, check each call against a policy of your own before the agent makes it, and keep the running total somewhere the agent can't edit.
What each provider actually enforces
OpenAI's spend limits guide says a hard spend limit can be set for the organization or an individual project, is monthly, and returns a 429 with organization_spend_limit_exceeded or project_spend_limit_exceeded once tracked spend reaches it. Spend alerts only send notifications and never stop traffic.
- Anthropic's rate limits and workspaces docs say each workspace can get its own monthly spend limit and rate limits, lower than but never higher than the organization's, and that organization-wide limits always apply even if workspace limits add up to more. Setting workspace spend limits through the API is an early access preview; the Console works today.
- OpenRouter's guide to capping shared agent keys recommends a credit limit on every agent key so one runaway agent can't drain a shared pool, plus a workspace budget as the pooled cap. Its authentication docs warn that a key with no limit lets a leaked key or a runaway agent spend the whole balance, including auto top-ups.
Why the caps leak a little
OpenAI says enforcement is not instantaneous and recorded spend can slightly exceed the configured amount while the limit state propagates. Plan for overshoot: set the cap below what you can afford, not at it.
- Monthly caps are coarse. A $300 monthly cap still lets an agent burn the whole $300 on the first afternoon. Where the provider offers daily resets (OpenRouter keys) or per-minute rate limits (Claude workspaces), use them as a short-term brake under the monthly ceiling.
- Caps only cover traffic billed to that project, workspace or key. If an agent can read another key from the environment or a shared secrets file, it can spend outside its budget, so give each agent only its own key.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before my research agent calls a paid API, check a $0.40 call to api.example-data.com against its own spending policy ($2 per call, $20 a day) and tell me whether to proceed.”
{
"tool": "authorize_spend",
"arguments": {
"credential_id": "<this agent's credential id>",
"amount_minor": 40,
"currency": "USD",
"merchant_domain": "api.example-data.com",
"category": "data_api",
"reference": "<your request id>"
}
}- Set the policy first with set_spend_policy (owner account key, toolset=trust): per_tx_max_minor, daily_max_minor, allowed_domains and allowed_categories per agent credential, so each agent has its own budget. The daily total resets at 00:00 UTC.
- authorize_spend returns a signed allow or deny receipt with reasons such as over_per_transaction_cap, over_daily_cap or merchant_not_allowed, and records it on Rightshold's ledger.
- GET /v1/spend/policies/{credential_id} (owner key) shows the current policy and spent_today_minor for that agent.
Rightshold records spending decisions; it never holds or moves money and doesn't connect to OpenAI, Anthropic or OpenRouter billing. Its policy only covers calls your agent checks with authorize_spend before making them, so keep the provider caps on as well. Not financial advice.
What are the sources?
- OpenAI API docs: Spend limits
- OpenAI Help: Managing projects in the API platform
- openai-go source: project spend limit (Admin API, cents, USD, month)
- Claude docs: Workspaces (workspace limits)
- Claude docs: Rate limits (spend limits, setting lower limits for workspaces)
- OpenRouter docs: Capping shared agent keys
- OpenRouter docs: API authentication (credit limit on every key)
Related
- How to see how much each AI agent spends on LLM API calls
- How to stop an AI agent from looping forever and burning tokens
- How to set a spending cap for an AI agent paying with x402
- How to require human approval before an AI agent spends money
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'