Unexpected OpenAI charges — how to find the cause
Last verified
Four things cause almost every surprise OpenAI bill. In rough order of frequency: a runaway loop in your own code, auto-recharge multiplying a bad day, a model or parameter change, and a leaked key. This page separates them.
Start here: open platform.openai.com/usage and look at daily cost for the billing period. The shape of that chart tells you which of the four you are dealing with.
Read the shape
| What the chart looks like | Most likely cause |
|---|---|
| One or two sharp spikes, then back to normal | A runaway loop or a batch job |
| A step change that never comes back down | A model change, a prompt change, or a traffic increase |
| Sustained elevated spend including nights and weekends | A leaked key |
| Normal usage, but several card charges | Auto-recharge — the usage is fine, the billing is confusing |
Cause 1 — a runaway loop
The most common cause, and the least suspicious-looking. A retry without a backoff, an agent that doesn't terminate, a recursive call, a test suite pointed at production.
Tells: the spike aligns with a deploy or a manual run; it's concentrated in one model; token counts per request look normal but request volume is absurd.
See the runaway loop: how a bug becomes a four-figure bill.
Cause 2 — auto-recharge
Not a usage problem — a _billing_ problem, and the one that most often produces the "why are there five charges?" question.
With auto-recharge on, your balance tops up automatically whenever it drops below a threshold. One heavy day can trigger several top-ups, each a separate charge. The usage was real; the number of charges is what surprises you.
It is also the mechanism that removes your worst-case cap entirely. Check Billing → Payment settings, and see how to turn off OpenAI auto-recharge.
Cause 3 — a model or parameter change
A step change with no spike usually means something about your requests changed, not their volume.
Common culprits:
- Switching to a more capable model. Frontier models can cost an order of magnitude more per token than small ones.
- A reasoning model with a high effort setting — reasoning tokens are billed output tokens, and they are invisible in the response you see.
- A longer system prompt, applied to every single request.
- More retrieved context per request in a RAG pipeline.
- Losing a prompt-caching hit because the cached prefix changed.
Group your usage by model and compare against your deploy history. If the step lines up with a release, it's this.
Cause 4 — a leaked key
Least common, most expensive. The signals are distinctive: models you never call, activity at hours you were asleep, and usage that continues while you're not shipping.
Full checklist in how to tell if someone is using your API key. If any of it matches, revoke immediately and investigate afterwards.
Getting the detail
The Costs endpoint gives you daily buckets you can group and diff:
curl "https://api.openai.com/v1/organization/costs?start_time=1717200000&limit=31" \
-H "Authorization: Bearer $OPENAI_ADMIN_KEY"Requires an admin key. More in the OpenAI Costs endpoint, explained.
Whichever it was
The reason this page is needed at all is that the invoice was the first thing that told you. Every cause above is visible in daily spend days before it shows up on a card — the data exists, nobody is looking at it.
Set a hard spend limit as a backstop, turn off auto-recharge so a bad day stays a bad day, and put today's number somewhere you'll see it without going to look. That last part is TKN: every provider, one number, checked against a rule you set.