Put a daily limit on every key

The limit goes on the gateway, so it covers every key that calls through it. Add it to the command that starts the gateway, then start it again.

The $50 below is an example: pick a little more than a key's busiest normal day.

AXIGATE_INGEST_KEY=<the key from Connect a gateway> axigate-finops gateway --ingest-url https://<your workspace>/api/ingest --max-spend-per-key-day 50

A scheduled job that starts a fresh run each time it fires gets a fresh --max-spend each time, so nothing limits its day. In one reported case, claude -p scripts on a schedule sent dozens of requests an hour and billed about $858 one day and $960 the next.

Give run a daily limit per key. Every run on this computer that writes the same ledger counts toward it, and it resets at midnight UTC.

*/20 * * * * axigate-finops run --max-spend 2 --max-spend-per-key-day 20 -- claude -p "<your prompt>"

Once the key reaches the limit, each run's next call on it is refused until midnight UTC, and so is the first call of a run that starts later. Each receipt says what the key spent today across runs, for example: today on key …7f2c: $20.1400 of the $20.00 daily limit, across every run on this computer · paused until midnight UTC.

With --stop-alert-url, a stop message goes from each run that was using the key when it reached the limit. A run that starts after that is refused without sending another, so a job that fires every few minutes does not send one per firing; its receipt says why none went. Give every job that uses the key the same --stop-alert-url, so a message goes whichever run reaches the limit.

For a key that should only ever spend so much, set a total instead of, or as well as, a daily amount. A key that reaches its total stays paused until someone resumes it, so start the gateway with an admin token too.

AXIGATE_INGEST_KEY=<the key from Connect a gateway> axigate-finops gateway --ingest-url https://<your workspace>/api/ingest --max-spend-per-key 200 --admin-token <token>

The gateway refuses that key's calls and says why in each refusal, and Needs a look lists the key. Where the dashboard runs beside a gateway that keeps its own count (serve on your own machines, without a shared count), the Keys page shows each key's spend against its limit and can resume a paused key; anywhere else, a key is resumed on its gateway.

On a shared server, Resume from another computer asks for a code first: the admin token the gateway was started with (--admin-token), or the dashboard code printed when it started.

A key at its daily limit works again at midnight UTC on its own. One at its total stays paused until it is resumed.

Resuming gives the key a fresh start: today's count begins again, and so does its total if the total paused it.

With run's daily limit (--max-spend-per-key-day on run), Resume on a run's Keys page lets only that run's calls through. Other runs, and runs that start later, still count the whole day, so the key stays paused for them until midnight UTC, or until they start with a higher --max-spend-per-key-day.

AxiGate never keeps a key. It recognises each one by a fingerprint and shows only its last four characters, like …a3f9.

The limit binds to the key itself, not to a name, so renaming a key can't get it around its limit.