Give every AI coding tool its own API key and a spend cap
An AI provider key works for whoever holds a copy. If one key is shared by your coding agent, your editor, a hosted console and three scripts, one leak exposes all of it, and you can't tell which tool ran up the bill. One key per tool, each with a hard cap at the provider, fixes both. Here's how, provider by provider, from their own docs.
The short version: make a separate key for each tool and cap it at the provider, because a cap inside a tool doesn't limit a copied key. Where the cap lives differs: OpenAI caps a project (and only stops traffic if you turn on Enforce a hard limit), Anthropic caps a workspace (not the Default one), Google caps a project (experimental, can run about 10 minutes over), and OpenRouter and Vercel AI Gateway cap a single key. Every cap lags a little, so set it at what you could afford to lose. Verified, read 19 Oct 2026
Why now: the OpenCode Console breach
On 17 Oct 2026 OpenCode posted on X that it "had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users". It said it had emailed them, that "if you did not get an email you were not impacted", that it was "a subset of users who had external providers linked", and that it was working with Anthropic, OpenAI and Google to remediate Verified, OpenCode on X, read 19 Oct 2026. Console is OpenCode's hosted service. OpenCode's Dax replied that this "is the OpenCode Console, not OpenCode itself, those keys never come to us" Verified, X reply, read 19 Oct 2026, and OpenCode's docs say keys added in the app with /connect are stored on your own machine Verified, OpenCode docs, read 19 Oct 2026.
The Hacker News reported that the intruder reached a legacy system on the night of 16 Oct, that the email's subject was "Action Required: Potential provider key breach", and that some users say they were charged for usage they didn't run, with individual claims from $168 to $1,700. It also noted that OpenCode's own wording is that keys "may have been exposed", and that OpenCode hasn't said any key was copied or used Reported, The Hacker News, 19 Oct 2026. A member of Anthropic's Claude Code team wrote that Anthropic had "revoked Claude API keys we believe were affected" Reported, X post, 17 Oct 2026. OpenCode called the incident ongoing, so details may change.
The general lesson isn't about OpenCode. Any service you hand a provider key to is one more place it can leak from, and as The Hacker News pointed out, a budget inside that service can't cap a copied key, because the service only sees requests that go through it Reported. The cap that works against a copied key is the one at the provider Inferred.
Where each provider lets you put a hard cap
Read on each provider's official docs on 19 Oct 2026. "Smallest unit" is the narrowest thing a cap can be attached to, which tells you how to split keys.
| Provider | Smallest unit you can cap | Hard stop? | What happens at the cap | Gaps the docs mention | Source |
|---|---|---|---|---|---|
| OpenAI API | Project. Keys belong to a project, and the cap is set on the project, not on one key. | Yes, but only if you switch on Enforce a hard limit. Without it, the limit only sends alerts and traffic continues. | Requests return 429 with project_spend_limit_exceeded. Resets with the next monthly cycle. | "Enforcement is not instantaneous", so spend "can slightly exceed" the limit. Monthly only. | OpenAI: Spend limits Verified, read 19 Oct 2026 |
| Anthropic Claude API (Console) | Workspace. A key can be scoped to a single workspace, and the cap is set on the workspace. | Yes. Workspace spend limits "cap monthly spending". | Requests return 400 with a message that begins "You have reached your specified workspace API usage limits". | You can't set limits on the Default Workspace. A workspace limit can't be higher than the organization's. | Anthropic: Workspaces · Rate limits Verified, read 19 Oct 2026 |
| Google Gemini API (AI Studio) | Project. Keys "have no independent billing settings"; all keys in a project count toward its cap. | Yes, but the project cap is marked Experimental. Separately, every paid billing tier has a monthly cap (Tier 1: $250). | At the tier cap, service is paused for every project on that billing account until the 1st of next month. The billing page doesn't say what a request gets at a project cap. | Overages for "around a 10 minute latency period"; batch jobs and agent sessions "may incur overages". Not available on invoiced accounts. Google Cloud alerts-only budgets don't cap anything. | Gemini API: Billing · Cloud budgets Verified, read 19 Oct 2026 |
| OpenRouter | One key. Each key gets its own credit limit. | Yes. OpenRouter recommends "setting a credit limit on every key". | Requests with that key are rejected until you raise the limit, or until a daily, weekly or monthly limit resets. | An optional setting controls whether bring-your-own-key (BYOK) usage counts toward a key's limit. | OpenRouter: Authentication · Key management Verified, read 19 Oct 2026 |
| Vercel AI Gateway | One key (also team, project or team member). | Yes, if you add a budget. "A team, project, key, or member without one has unlimited spend." | Requests return 402 with quota_for_entity_exceeded until the budget resets or you raise it. | BYOK spend (your own provider keys) isn't counted in budgets. Budget changes take "up to about 5 minutes for a key in active use". | Vercel: AI Gateway budgets Verified, read 19 Oct 2026 |
| Vercel Token Pass | Team. All members and Token Pass keys share one balance. | Yes, by design: "Overage: None." | Requests with a Token Pass key fail with 403 until the next billing period. | $30 per team per month for $80 of credit, Pro teams only, Early Access, featured models only (Kimi K3, GLM 5.3). No per-key split. | Vercel: Token Pass billing Verified, read 19 Oct 2026 |
| OpenCode Console | Workspace, and each team member. | Yes for Console's own billing: with a $20 limit, "Console will not use more than $20 in a month". | Console stops using credit for that month. | With auto-reload on, "you might still be charged more". It caps what Console spends, not what a copied provider key can spend elsewhere. | OpenCode: Console docs Verified, read 19 Oct 2026 |
Quotes are from the linked pages. Where a page doesn't say something (for example, the response a request gets at a Gemini project cap), we say so rather than guess. Not checked: Azure OpenAI, AWS Bedrock, Mistral, DeepSeek, xAI, Groq, and subscription sign-ins like Claude or ChatGPT plans.
Alert-only traps
OpenAI: "Spend alerts do not enforce a cap." Google Cloud: an alerts-only budget "doesn't automatically cap" spending. Vercel: alerts below 100% "never" block requests. An email at 3am doesn't stop an agent loop. Verified, read 19 Oct 2026
Caps that can run over
OpenAI: spend "can slightly exceed" a hard limit. Google: overages for "around a 10 minute latency period". Vercel: budget changes take up to about 5 minutes for a busy key. So a cap is a ceiling with some give, not an exact number. Verified, read 19 Oct 2026
Top-ups can undo a cap
OpenRouter warns that a key with no limit can spend "your entire balance, including any auto top-ups". OpenCode Console says with auto-reload on "you might still be charged more" than your monthly limit. Check your auto-reload settings. Verified, read 19 Oct 2026
How to do it: 7 steps
Roughly 30 minutes for a handful of tools (our estimate). You need an owner or admin login at each provider.
List every place that holds an AI key
Write down each coding agent, editor, CLI, app builder integration, script and CI job that has an OpenAI, Anthropic, Gemini, OpenRouter or gateway key, and which key it uses. Include hosted services you pasted a key into, like OpenCode Console. If one key shows up twice, that's what this guide fixes.
Give each tool its own project or workspace at the provider
Caps live at different levels. OpenAI caps a project, Anthropic a workspace, the Gemini API a Google project. So create one per tool there (for example "claude-code-laptop" or "opencode-console"). On Anthropic, don't use the Default Workspace: limits can't be set on it. OpenRouter and Vercel AI Gateway cap a single key, so there one key per tool is enough.
Create one key per tool, named after it, with an expiry where offered
Make the key inside that tool's project or workspace and name it after the tool and date. OpenAI recommends an expiration date on project keys and regular rotation. Anthropic lets you pick an expiry when you create a key (3 hours to 30 days, a custom length, or never), and it can't be changed later.
Set a hard cap, not just an alert
Use the provider steps below. Pick the most you'd be willing to lose if the key leaked this month, not your hoped-for usage. On OpenAI, the switch that makes a limit stop traffic is Enforce a hard limit. Alerts alone never stop a request on OpenAI or Vercel, and Google Cloud alerts-only budgets don't cap spending.
Add alerts below the cap
An alert at 50% or 75% tells you something is off before the cap cuts the tool off. OpenAI spend alerts, Anthropic workspace alerts and Vercel's 50/75/100% emails are all set next to the limit. For Google, the Gemini docs suggest billing alerts in the Google Cloud console.
Keep keys out of code, browsers and prompts
Load keys from environment variables or a secrets manager. OpenAI and Google both say never to ship a key in browser or mobile code; send those requests through your own server. Don't paste keys into an AI chat either: the tool may keep them in its chat history.
Check usage per key after big agent runs
OpenAI's Usage page can track usage per API key, Anthropic's usage and cost reports show the workspace, and Vercel shows spend per key. A spike on one tool's key is easy to spot when it isn't mixed in with everything else. That's half the point of one key per tool.
Setting the cap, provider by provider
OpenAI
Project settings → Limits → in Spend, Edit spend limit → enter the Monthly spend limit → turn on Enforce a hard limit → Save. You need permission to manage that project. Verified, docs, read 19 Oct 2026
Anthropic
Claude Console → Workspaces (platform.claude.com/settings/workspaces) → pick the workspace → Spend limits. Set the monthly cap and alert thresholds there. Organization-wide: Billing → Spend limits → Adjust limit or Set limit. If you sign in to Claude Code with a Console account, Anthropic makes a separate Claude Code workspace, the only one that supports per-user monthly spend limits. Verified, docs, read 19 Oct 2026
Google Gemini API
Google AI Studio → Spend page → Monthly spend cap → Edit spend cap, per project. You need the project editor, owner or admin role. Remember it's experimental and can run over by about 10 minutes of usage. Verified, docs, read 19 Oct 2026
OpenRouter
When you create a key, give it a name and a credit limit, optionally resetting daily, weekly or monthly. To change it later, edit the limit on the key's page. Verified, docs, read 19 Oct 2026
Vercel AI Gateway
AI Gateway API Keys page → Create key → turn on the budget, enter a dollar limit → choose a refresh period → save, and copy the key (you can't see it again). CLI: vercel ai-gateway api-keys create --name my-api-key --limit 10 --refresh-period monthly. Keys using your own provider keys (BYOK) aren't covered by budgets, so cap those at the provider. Verified, docs, read 19 Oct 2026
Vercel Token Pass is a different shape: a $30-a-month team subscription with $80 of credit for its featured models and no overage. When the credit runs out, Token Pass requests fail with a 403 until the next billing period. It's a hard ceiling, but one shared by the whole team, not a per-tool cap Verified, Vercel docs, read 19 Oct 2026.
How to rotate a leaked key
If a key might be exposed (a breach notice, a key pushed to GitHub, a key pasted into a chat), do these in order. OpenRouter says it's a GitHub secret scanning partner and emails you if it finds a compromised key Verified, read 19 Oct 2026, but don't wait for an email.
Make the new key first
Create the replacement in the same project or workspace (with a cap). Google's checklist starts here, and says not to delete the old key until the new one is fully active, so nothing breaks mid-swap.
Swap it into the tool
Update the environment variable, secrets manager entry or the tool's own setting. In the OpenCode app that's the
/connectcommand; OpenCode's docs say keys added that way are stored on your machine in~/.local/share/opencode/auth.json.Revoke the old key at the provider, not in the tool
Removing a key from a tool doesn't stop a copy someone else holds. Only the provider can kill it. OpenAI: rotate it on the API Keys page. Anthropic: Disable (reversible) or Delete (permanent) on the API keys page. Google: disable or delete it in the Cloud console. OpenRouter: delete it on the key settings page and create a new one.
Read the usage logs back to the earliest possible exposure
Look for models, times and volumes you don't recognise. For the OpenCode Console incident, The Hacker News advises going back at least to 16 Oct 2026. Google's checklist says to check billing logs and API usage in the Cloud console.
Cap it, then ask about charges you didn't make
Set or lower the cap on the new key's project, workspace or key. For charges you didn't run, contact the provider; OpenAI's help page says to contact it through help.openai.com if you have concerns about misuse.
Sources, all read 19 Oct 2026: <a href="https://ai.google.dev/gemini-api/docs/api-key" rel="nofollow noopener" target="_blank">Google leak response checklist</a> · <a href="https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety" rel="nofollow noopener" target="_blank">OpenAI API key safety</a> · <a href="https://platform.claude.com/docs/en/manage-claude/authentication" rel="nofollow noopener" target="_blank">Anthropic key management</a> · <a href="https://openrouter.ai/docs/api-reference/authentication" rel="nofollow noopener" target="_blank">OpenRouter: if your key has been exposed</a>.
Honest limits
- This is a docs guide, not a test. "Verified" means the provider's own docs said it on 19 Oct 2026. We haven't hit any of these caps ourselves, so we can't tell you how fast each one really stops traffic.
- A cap limits money, not access. Until you revoke a leaked key, whoever holds it can still use it up to the cap, along with anything else the key can reach.
- Caps lag (see above). Set them below what you can afford to lose, not at it.
- Docs and prices change. Vercel Token Pass is Early Access and Google's project caps are experimental. Check the linked page before relying on a detail.
- OpenCode facts are as of 19 Oct 2026 and the incident was described as ongoing. Charge amounts are user claims reported by the press, not confirmed by OpenCode.
- We haven't tested OpenCode or any coding agent yet. It's a candidate on our open-source coding agents list, unranked.
Keep going
- Pre-launch checklist, step 7: search the code your app sends to browsers for secret keys.
- The two-account test: check whether one user of your AI-built app can see another's data.
- Coding agents we plan to test: AI coding agents · open-source coding agents (unranked).
- All guides · How we test
Evidence labels: Verified = read on the named official page or account on 19 Oct 2026 (link given). Reported = said by a third party such as a news site, not checked by us. Inferred = our reading of the evidence. What the labels mean. Disclosures: no provider or tool named here paid us, and there are no affiliate links on this page.
FAQ
Can I set a spend limit on a single OpenAI API key?
Not on the key itself. OpenAI sets spend limits per organization and per project, and a project hard limit applies only to traffic billed to that project. So put each tool's key in its own project, set a monthly spend limit and turn on Enforce a hard limit; without that switch the limit only sends alerts. Requests over a hard limit get a 429 error, and spend can slightly exceed the limit because enforcement isn't instantaneous (OpenAI docs, read 19 Oct 2026).
Can I cap spending per API key on Anthropic's Claude API?
Per workspace, not per key. Anthropic lets you scope a key to a single workspace and set a monthly spend limit on that workspace in the Claude Console (Workspaces, then Spend limits). Limits can't be set on the Default Workspace, and a workspace limit can't be higher than the organization's. Over the limit, requests return HTTP 400 (Anthropic docs, read 19 Oct 2026).
Does the Gemini API have a hard spending cap?
Yes, two kinds. Each paid billing tier has a monthly cap (Tier 1 is $250), and when it's reached, service pauses for every project on that billing account until the 1st of the next month. You can also set your own project spend cap in AI Studio, but Google marks it experimental: overages are possible for about 10 minutes, and batch jobs and agent sessions may run over. Google Cloud alerts-only budgets don't cap spending (Google docs, read 19 Oct 2026).
Which AI providers let me cap a single API key?
Of the ones we checked on 19 Oct 2026, OpenRouter and Vercel AI Gateway. OpenRouter gives every key its own credit limit, optionally resetting daily, weekly or monthly, and recommends a limit on every key. Vercel AI Gateway lets you set a budget per API key, but spend through your own provider keys (BYOK) isn't counted. OpenAI, Anthropic and Google cap a project or workspace instead, so give each tool its own.
I saved a provider key in OpenCode Console. What should I do?
OpenCode says only the 1.4% of Console users it emailed were affected, a subset who had external providers linked. If you want to be safe anyway: create a new key at the provider, put it in your tools, revoke the old one at the provider (only the provider can stop a copy from working), check usage back to 16 Oct 2026, and set a spend cap on the new key's project or workspace.
Was the OpenCode app on my computer part of the breach?
OpenCode says the breach was in OpenCode Console, its hosted service. OpenCode's Dax wrote on X that it was "the OpenCode Console, not OpenCode itself" and that those keys "never come to us". OpenCode's docs say keys added with the /connect command are stored on your own machine. As of 19 Oct 2026 OpenCode called the incident ongoing.
How to cite
VibeTierList, "Give every AI coding tool its own API key and a spend cap", provider docs read 19 Oct 2026. https://vibetierlist.com/guides/api-key-spend-cap/