Guides — AI API spend, keys, and cost control

Everything here is written to be used, not skimmed. Direct answers first, real console URLs and API calls, sources linked, and a verified date on every page.

Leaked keys & incident response

• Your OpenAI API key leaked — do these 6 things nowA leaked OpenAI key can be drained in minutes. Revoke it, check for unauthorised usage, purge it from git, and stop the bleeding — in order, with the exact URLs.
• How to tell if someone is using your API keySix signals that an AI API key has been compromised, where to look for each in OpenAI, Anthropic and xAI, and what to do the moment one shows up.
• How to revoke an OpenAI API keyThree ways to revoke an OpenAI API key — the console, the admin API, and from your phone — plus what actually happens to running services when you do.
• I committed an API key to GitHub — now what?Deleting the commit does not help. Here is the correct order — revoke, reissue, purge history, check usage — and why force-pushing alone leaves the key live.
• LLMjacking — how AI key theft works, and how to stop itLLMjacking is the theft and resale of AI API credentials. Here is how keys are harvested, why the economics work, and the controls that actually reduce the damage.
• How to remove an API key from git historygit filter-repo and BFG, step by step, plus the parts nobody mentions — forks, existing clones, cached commits, and why this is step six and not step one.
• Your Anthropic API key leaked — the response, step by stepRevoke a compromised Anthropic key in the console or via the admin API, check your organisation cost report for abuse, and cap the account so it cannot happen twice.
• Unexpected OpenAI charges — how to find the causeWork out whether a surprise OpenAI bill is a leaked key, a runaway loop, a model change, or auto-recharge — and which of the four it is, in about ten minutes.
• Why you can't ship an API key in a mobile appEvery trick for hiding an API key in a mobile binary has been broken. Why obfuscation fails, what 282 leaking iOS apps tell us, and the only architecture that works.

Provider keys & billing APIs

• How to create an OpenAI admin key (and what it can do)Admin keys read your organisation's usage and cost and can manage other keys. How to create one, what it can and cannot do, and how to hold it safely.
• How to create an Anthropic admin keyAnthropic admin keys read organisation usage and cost and can deactivate API keys. Where to create one, the endpoints it unlocks, and how to hold it safely.
• xAI management keys vs inference keysGrok billing data needs a management key, not the xai- key you use for inference. What the difference is, where to create one, and why team scope matters.
• Is it safe to give an app your admin key?An admin key can delete every key in your organisation. Six questions to ask before handing one to a third-party tool, and what a good answer looks like.
• The OpenAI Costs endpoint, explainedQuery your OpenAI spend programmatically — the Costs endpoint, its parameters and daily buckets, plus the gotchas that make people think it is broken.
• The OpenAI Usage API, with working examplesPull token counts by model, project, key and user from the OpenAI Usage API — the parameters that matter, and when to use it instead of the Costs endpoint.
• Tracking Gemini API spend via Google Cloud BillingGemini has no simple API key path to billing data. Here is how spend actually surfaces — via Cloud Billing, BigQuery export and budget alerts — and what that means.
• OpenAI key types — project, service account, adminWhich OpenAI key does what, how to recognise each by prefix, and which one you need for inference, for billing data, and for revoking other keys.
• Why provider billing APIs are daily, not real-timeEvery major provider reports cost on a daily cadence. What that means for spend alerts, why "real-time" tools are estimating, and how to design around it.

Tracking AI spend

• How to track OpenAI API costs — 5 methods comparedThe dashboard, the Costs API, CSV export, a proxy, and a phone app — what each one actually gives you, what it costs, and which to pick.
• Tracking costs across OpenAI, Anthropic, Grok and GeminiFour providers, four different billing models, four different credentials. What each one needs, why the totals never quite line up, and how to get one number.
• LLM cost tracking without a proxy or an SDKTrack AI spend without routing production traffic through a third party. What billing-API tracking gives you, what it costs you, and when a proxy is better.
• How to check your AI API spend from your phoneProvider consoles are painful on mobile and none of them combine. The options for checking OpenAI, Anthropic, Grok and Gemini spend from a phone, compared.

Budgets & spend limits

• OpenAI spend limits — hard, soft, and what they missWhat OpenAI hard and soft spend limits actually do, the four gaps they leave open, and how to configure them so a bad day cannot become a catastrophic one.
• How to turn off OpenAI auto-recharge (and why you should)Auto-recharge is what turns a capped loss into an uncapped one. Where the setting lives, what happens when you disable it, and when leaving it on is defensible.
• The runaway loop — how a bug becomes a four-figure billThe five code patterns that quietly burn AI credits — retries, agent loops, recursion, batch fan-out, and tests against production — and the guards that stop each.
• Getting alerted when AI spend spikesProvider alerts, a DIY daily digest, or a tracker that watches for you — the three ways to hear about an AI spend spike, and what each can and cannot catch.
• How to cap Anthropic API spendingWhere Anthropic's spend controls live, how automatic credit purchase can defeat them, and a configuration that bounds your worst case.
• Setting budget alerts for Gemini via Google CloudCloud Billing budgets are the practical brake on Gemini spend. How to scope one to the Generative Language API, and why it notifies rather than stops.

Agents & MCP

• Cost control for autonomous agentsAgents decide how many tokens to spend, and cost grows as the transcript grows. The five guards that bound an agent run, and why the model cannot enforce them.
• Cost tracking for MCP servers and agentsHow Model Context Protocol servers change the cost picture, why an agent that can read its own spend is useful, and how to wire one up.
• How to give an AI agent a spending limitFour layers of budget enforcement for an agent — in the loop, on the key, at the provider, and at the account — and which ones actually hold under pressure.
• What Claude Code actually costs (and how to see it)Claude Code writes complete token counts to disk. Here is where they live, how to price them yourself, and why cache reads dominate the bill.
• Why Claude Code feels expensive (the token mechanics)You are not paying for what you typed. Measured from a real session — cache reads were 98% of tokens and 60% of cost. Here is the mechanism.
• How to reduce Claude Code costsNine changes ranked by measured effect, based on where the money actually goes — cache reads and context growth, not the text you type.
• Where Claude Code stores usage data — and how to read itThe JSONL session log format, field by field, with the deduplication rule that most homemade cost calculators get wrong.
• Subscription plan vs pay-per-token — which is cheaper for youYour local session logs already contain the answer. How to compute what your plan usage would have cost on metered API billing, and read the result honestly.