Stop Surprise AI API Bills: Spending Limits, Keys and Monitoring

Why AI API bills surprise small businesses

Most AI API costs are tiny per request, which is why nobody watches them. Problems come from volume you didn't plan for.

• Leaked key: a key pasted into website JavaScript, a public code repository or a shared document gets found and used by others.
• Runaway loop: an automation or agent that retries endlessly, or calls the model on every page view.
• Abuse of a public chatbot: someone uses your website assistant as a free general-purpose AI.
• Expensive model by default: a developer tested with the top model and nobody switched it back.
• Long context: every request sends a whole document or chat history, multiplying input tokens.

To estimate what normal usage should cost, see our guides to LLM token costs per customer reply and API pricing per token. Knowing the normal number is what makes an alert useful.

Spend limits by provider (OpenAI, Anthropic, Gemini)

All three providers now separate notification-only alerts from limits that actually stop traffic. The details differ.

Sources: OpenAI's spend limits guide, Anthropic's rate and spend limits page and Google's Gemini API billing page. OpenAI notes that enforcement "is not instantaneous", so recorded spend can slightly exceed the limit; Google says the same about billing data delays.

Set up spend limits step by step

The same pattern works on each platform. Do it before the AI feature goes live.

1. 1

   Create a project or workspace per app

   One for the website chatbot, one for internal tools, one for testing. OpenAI uses projects, Anthropic uses workspaces, Gemini uses Google Cloud projects in AI Studio.

2. 2

   Estimate normal monthly spend

   Multiply expected requests by average tokens and the model's price. Set the hard limit at roughly two to three times that, so a busy month still works but a leak doesn't drain the account.

3. 3

   Turn on the hard limit

   OpenAI: Project settings, Limits, Edit spend limit, Enforce a hard limit. Gemini: AI Studio, Spend, Monthly spend cap. Anthropic: Console, Billing, set your own spend limit.

4. 4

   Add alerts below the limit

   For example at 50% and 80% of the limit, sent to a shared mailbox that someone reads, not one developer's inbox.

5. 5

   Plan what happens at the limit

   Your app should handle the 429 error gracefully, for example showing "Our assistant is unavailable, please WhatsApp us" rather than breaking the page.

API key safety: scoping, storage and rotation

Spend limits cap the damage; good key handling prevents it. OpenAI's API key safety article lists the basics: a unique key per team member, never deploying keys in browsers or mobile apps, secure storage, monitoring, rotation and IP restrictions. Administrators can also enforce a maximum key lifetime.

AI-generated code is a common source of leaks, because quick prototypes often put the key straight into the front end. Our vibe-coding risks guide covers this and other security gaps in AI-built apps.

Protect a public chatbot from abuse

A chatbot on your website is a public door to a paid API. Even with a spend cap, abuse can exhaust your budget and take the bot offline for real customers.

A weekly monitoring routine

Five minutes a week is enough for most small businesses.

• Open each provider's usage dashboard and compare this week's spend with last week's.
• Check spend per project or key; a sudden jump on one key points to the cause.
• Look at which models are being used; an expensive model appearing unexpectedly is a red flag.
• Confirm alerts still go to a monitored address.
• If something looks wrong, revoke the key first and investigate second.

If a key has leaked, revoke it immediately, create a new one, update the app, check usage logs for when the misuse started, and contact the provider's support about unexpected charges.

Do it yourself or get help?

Setting spend limits and alerts takes minutes and every business using AI APIs should do it now. Help is worth it when an app was built quickly with keys in the front end, when you need a server-side proxy with rate limits, or when you aren't sure where keys have been copied.

Our Security Health Check (S$290) reviews where keys are stored, who has access and what limits are set. For a properly built AI feature with server-side keys, rate limits and usage reporting, our Custom Tool or Dashboard service starts at S$1,990.