LLM spending limits per API key or customer for OpenAI and Anthropic (2026)

OpenAI added organization and project hard spend limits in July 2026, so advice that its budgets only send alerts is out of date. As of October 2026, Anthropic also has organization and workspace limits. For one monthly cap per customer across both providers, route their calls through a capped gateway key. We make Requesty, which provides that key.

What each spending limit covers

The real question is where the budget sits. OpenAI and Anthropic each give you a boundary inside their own account. Neither provider's general API documentation describes a monthly dollar cap on an individual API key.

There is one Anthropic per-user exception: the automatically created Claude Code workspace supports per-user monthly limits. It does not give one of your SaaS customers a general API key cap of their own.

A spend cap, an alert and a rate limit each do a different job. An alert sends a notification; a spend cap rejects new traffic at its boundary; a rate limit controls request or token throughput. Requesty limits concurrent in-flight requests, not requests per minute. An agent also needs a run or step limit inside the application: a monthly budget does not tell it when to stop a single task.

Set an OpenAI or Anthropic limit

For one provider, a dedicated project or workspace is the simple answer. At larger customer counts, account for the administrative boundary: OpenAI defaults to 2,000 projects per organization, while Anthropic defaults to 100 workspaces, excluding archived workspaces.

Set a monthly limit per API key or customer with Requesty

Requesty gives each customer one monthly key limit across their routed OpenAI and Anthropic calls. Per-key limits are available on every plan; paid models need credits, added through Billing settings and Top up. Pay as you go carries a 5% fee on top of credit top-ups, with no seat fees or minimum spend. The Key Management API is an Enterprise feature.

1. 1
   Create a key and set its limit

   Open API Keys, create a key or edit an existing one, and set its monthly spending limit. Give each customer a separate key. For this example, assume a $50 monthly customer limit. The key limit guide describes the console workflow.

2. 2
   Map the customer to the key

   Keep the key on your server and map it to the signed-in customer account. Select that key when the customer makes an inference request. Do not let a client choose another customer's key by passing a customer ID in request metadata. Keep provider and management credentials on the server too.

3. 3
   Send requests through Requesty

   Set REQUESTY_CUSTOMER_KEY to the customer's key in your server environment. This Chat Completions request uses an OpenAI model and incurs a model charge:

   Shell

   Copy

   curl -i 'https://router.requesty.ai/v1/chat/completions' \
     -H "Authorization: Bearer $REQUESTY_CUSTOMER_KEY" \
     -H 'Content-Type: application/json' \
     -d '{
       "model": "openai/gpt-6-luna",
       "messages": [{"role": "user", "content": "Say hello."}],
       "max_tokens": 256
     }'

   For Anthropic, use the same key and request format, replacing the model with anthropic/claude-sonnet-5-5. Both IDs are in the Requesty model catalog. For the Anthropic SDK, Requesty also supports the Messages API at https://router.requesty.ai/v1/messages.

Leave the provider-side limits in place as a second line of defense. Review Requesty usage alongside provider and tool invoices for the same period, checking for overlap before adding totals. Requesty's cost view separates Requesty-managed and provider costs when you bring your own provider keys.

Create capped keys during onboarding

For an Enterprise account, automate the same setup with the create key endpoint. Set REQUESTY_MANAGEMENT_KEY to a separate key with management write permission before running this example:

curl -X POST 'https://api-v2.requesty.ai/v1/manage/apikey' \
  -H "Authorization: Bearer $REQUESTY_MANAGEMENT_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "customer-acme-prod",
    "monthly_limit": 50,
    "permissions": {"manage": "none", "completions": "write"}
  }'

The example sets a $50 monthly limit and gives the customer key completion permission, but no management permission. The response contains api_key_id and api_key. Save the ID for later management and store the secret safely: Requesty shows the key string only once. A monthly_limit of 0 means unlimited, according to the key reference.

Add a warning before the cutoff

In Admin Panel, open Alerts, select Add Webhook, and configure a JSON, Slack or Teams endpoint. Then select Add Alert, choose API Key % of Budget, and enter a threshold. For the $50 example, an 80% alert means $50 x 0.80 = $40 of recorded key spend.

The percentage alert requires a key limit. A threshold without a valid webhook is stored but sends no notification. See the current alert setup and our guide to spend alerts and webhooks. An alert buys someone time to act; the key limit is the control that blocks new requests.

Verify the cutoff and recovery

Use a dedicated test key with a small spend allowance. A good test shows three things for both providers: a successful call, a budget rejection, and recovery.

Set REQUESTY_CUSTOMER_KEY to the test key and TEST_KEY_ID to its ID, then use an Enterprise management key with read permission to inspect its starting spend:

curl 'https://api-v2.requesty.ai/v1/manage/apikey/'"$TEST_KEY_ID" \
  -H "Authorization: Bearer $REQUESTY_MANAGEMENT_KEY"

Run the inference command above once for OpenAI and once for Anthropic; after each call, record the response's usage.cost, repeat the GET and compare monthly_spend with the previous reading. Both calls incur charges. If the expected increase is not visible, investigate before proceeding.

Once spend is positive, set NEW_LIMIT to an accepted positive amount below monthly_spend and use a management key with write permission to update it:

curl -i -X POST "https://api-v2.requesty.ai/v1/manage/apikey/$TEST_KEY_ID/limit" \
  -H "Authorization: Bearer $REQUESTY_MANAGEMENT_KEY" \
  -H 'Content-Type: application/json' \
  -d "{\"monthly_limit\": $NEW_LIMIT}"

The update endpoint returns 204 on success; repeat the GET to confirm the positive monthly_limit is below monthly_spend. If you cannot set a positive amount below recorded spend, set a low positive test cap you can afford. Make at most 10 short requests, checking recorded spend after each. If the cap is still not reached, stop and review the test amount and model pricing.

Repeat both model requests with the test key. The budget response to check is HTTP 412, error.origin of router, and a monthly spend limit message. Requesty blocks new requests for a key at its limit until the next billing period; an admin can also raise the limit and retest. Because the current message can refer to a key, user or group, inspect the test key's recorded spend and the other applicable limits to identify the boundary that blocked the call.

For manual setup, inspect and edit the test key in the console instead. If the expected rejection does not appear, check which key the application sent, whether it called the gateway, and which error came back. The delete endpoint is available for Enterprise automation.

Read the error before retrying

A 429 on its own does not tell you it is a budget problem. The OpenAI and Anthropic rows below describe direct provider API responses. For requests through Requesty, inspect the returned status, error.origin and error.message; provider errors can be translated by the gateway.

The Anthropic Claude Code workspace exception described above can also return 429 with retry-after. For a temporary request or token throughput limit, follow the provider's rate-limit guidance. On a budget error, stop automatic retries, surface the interruption to the customer, and decide who can raise the limit or resume the workload.

Choose the right budget boundary

The math changes as soon as you add keys or providers. Assume a customer has a $100 OpenAI project limit and a $100 Anthropic workspace limit. Those separate provider controls allow $100 + $100 = $200 of combined configured spend, before any overage. A single $100 Requesty customer key instead gives the routed calls one shared key budget across the two providers.

Two $50 Requesty keys for the same customer are two separate allocations: $50 + $50 = $100. If the customer needs multiple credentials under one shared pool, use an appropriate shared budget scope or an application ledger; labeling both keys with the same customer ID does not merge their caps. Pick Bifrost for a customer-wide budget across attached virtual keys: it checks applicable customer and key budgets independently. Use a ledger if you need your own shared enforcement across systems.

Requesty also has monthly limits for organization members and an organization-level cap. For teams, groups are an Enterprise feature. In the default Global mode, the group setting grants each member a user limit. A pooled group budget requires Group Budget mode, which support enables. A member limit is for an organization user; a customer ID attached to an inference request is a reporting field.

For self-hosting or a daily limit alongside a monthly one, pick LiteLLM virtual keys, which support multiple budget windows through budget_limits. LiteLLM requires a database for budget enforcement. Review normal spend regularly, leave headroom for growth and concurrency, and pair the monthly cap with application-level retry and run limits. Our guide to capping runaway agent spend covers the agent side of that problem.

What to do this week

If you only use one provider, its native project or workspace cap does the job. Once you have several providers or many customers, give each customer one capped gateway key and test the cutoff before you need it. Create a Requesty account to set your first key limit.