TKN.

Getting alerted when AI spend spikes

Last verified

Three options. Provider alerts (free, coarse, monthly-cumulative), a DIY daily digest (free, yours to maintain), or a tracker that watches and can act (paid, least effort).

All three are constrained by the same thing: billing data is daily. Nothing that reads billing APIs will page you 90 seconds into a runaway loop.

Option 1 — provider spend alerts

Every major provider offers a threshold notification.

  • OpenAI — spend alerts alongside the hard limit, in billing settings
  • Anthropic — organisation spend thresholds
  • Google — Cloud Billing budgets with percentage thresholds
  • xAI — team billing controls

Good: free, official, five minutes to set up. Set them today regardless of what else you do.

Bad, and it matters: these fire on cumulative spend against a limit, usually monthly. An alert at 50% of a monthly budget tells you nothing about _today_. A day that costs 20× normal won't trigger anything until the accumulated total crosses the line — which might be a week later, long after the money is gone.

They are a budget-consumption warning, not an anomaly detector. Useful, but not the thing most people think they're getting.

Option 2 — a daily digest you build

Fetch yesterday's spend and post it somewhere you actually read.

#!/usr/bin/env bash
set -euo pipefail
START=$(python3 -c 'import time; print(int(time.time()) - 86400)')
THRESHOLD=25.00

TOTAL=$(curl -s "https://api.openai.com/v1/organization/costs?start_time=$START&limit=1" \
  -H "Authorization: Bearer $OPENAI_ADMIN_KEY" \
  | jq '[.data[].results[].amount.value] | add // 0')

MSG="OpenAI spend yesterday: \$$TOTAL"
if (( $(echo "$TOTAL > $THRESHOLD" | bc -l) )); then
  MSG="🔴 SPEND ALERT — $MSG (threshold \$$THRESHOLD)"
fi

curl -s -X POST "$SLACK_WEBHOOK" -H 'content-type: application/json' \
  -d "{\"text\":\"$MSG\"}"

Cron or a scheduled GitHub Action. Needs an admin key.

Good: you control the threshold and the channel. Compares against _a day_, which is the comparison that actually detects anomalies.

Bad: one integration per provider, and you maintain it. A digest that fires every day is also easy to start ignoring — which is why the threshold check matters more than the digest.

Option 3 — a tracker that watches for you

An app that reads the billing APIs, holds a threshold, and tells you when it's crossed.

The thing worth insisting on: can it act, or only inform? An alert that leads to "open a laptop, find the console, sign in, locate the key" has a long tail between knowing and stopping, and that tail is where the money goes.

TKN checks your spend rules against live daily spend across OpenAI, Anthropic, xAI and Gemini, and puts the kill switch on the same screen as the number — so the response to a bad figure is one action, not a project.

Setting a threshold that works

The most common mistake is a round number. $100 means nothing about your system.

Do this instead:

  1. Look at the last 30 days of daily spend.
  2. Take a normal day — the median, not the mean, so a single spike doesn't skew it.
  3. Set the threshold at roughly 3× the median.

A project averaging $8/day should alert at $25. High enough to ignore ordinary variation, low enough to catch a genuine problem the same day.

Revisit it when your traffic changes. An alert that never fires has been quietly disabled by growth; one that fires constantly gets muted, which is worse than not having it.

What alerts cannot do

They tell you _that_, never _why_. A spike could be a launch, a model change, a runaway loop, or a stolen key. The alert cannot tell the difference — unexpected charges: how to find the cause is the follow-up.

And an alert stops nothing on its own. Pair it with a hard spend limit so there's a ceiling even when nobody is reading.

Sources

Related