What OpenAI lets you limit
OpenAI has two spend controls, and both cover a whole organization or project. A spend alert sends a notification and lets traffic continue. A hard limit stops it: once the organization or project reaches its monthly amount, requests fail with a 429 error coded organization_spend_limit_exceeded or project_spend_limit_exceeded until you raise or remove the limit or the next monthly cycle starts.
OpenAI is upfront about the lag: "Enforcement is not instantaneous, so recorded spend can slightly exceed the configured amount." Rate limits work at the same level. In OpenAI's words, they "are defined at the organization level and at the project level, not user level."
A single key gets permissions (All, Restricted or Read Only) and an optional expiration date, and since August 2026 the Usage and Spend dashboards break spend down by key. That shows which key spent the money. It doesn't stop the next request.
Why a per-key cap needs a gateway
Every key in a project draws on the same monthly budget. One agent stuck in a retry loop, or one leaked key, can spend the month before anyone looks, and when the hard limit trips, it stops every other key in the project too.
OpenAI's closest workaround is a project per app or agent, each with its own hard limit. It still can't cap an hour or a day, enforcement still isn't instantaneous, and every new agent needs a new project.
A cap per key, per day or per agent needs something between your code and OpenAI that counts what each key spends and refuses a request before it goes out. That's the job Keylayer does.
How a Keylayer spend cap works
You add your OpenAI key to Keylayer's vault once, then mint Keylayer keys from it, each with its own limits. Your code sends a Keylayer key to the relay instead of the OpenAI key, and two lines change:
client = OpenAI(
base_url="https://relay.keylayer.dev/v1",
api_key=os.environ["KEYLAYER_KEY"],
)A spend cap is a dollar amount per UTC hour, day, week or month, and one key can carry a cap for each period at once. Before forwarding a request, Keylayer reserves its worst case: about one token per byte of the body, plus the output limit the request sets, at the model's prices. It refuses with 403 budget_exceeded if what the key has spent, plus what its running requests hold, plus that reservation would pass a cap. When the response ends, Keylayer charges the usage OpenAI reports and frees the rest.
Without an output limit, Keylayer reserves the model's maximum output. On gpt-5.4-mini that's 128,000 tokens, about $0.58 for every request in flight, so set max_completion_tokens, or max_output_tokens on the Responses API, to what you need and more requests fit under the same cap.
A hard cap refuses what Keylayer can't price up front, such as web search and other built-in tools, with 403 unpriced_operation, and it suspends the key if OpenAI ever reports more than the reservation. An estimated cap lets those calls through on an estimate, so spend can pass the cap. The spend caps docs list every case.
A Keylayer key next to OpenAI's limits
| Control | Keylayer key | OpenAI |
|---|---|---|
| Spend cap covers | One key, and every key minted from it | An organization or a project |
| Spend cap period | A UTC hour, day, week or month, all at once | A calendar month |
| When it's enforced | Before the request goes out, against its worst case | Not instantaneous, so spend can slightly exceed it |
| Over the cap | 403 budget_exceeded, with retry-after set to the reset | 429 project_spend_limit_exceeded |
| Rate limits | Requests a minute and requests at once, per key | Per organization and project, per model |
| Key expiry | 1 hour by default, up to 365 days | Optional expiration date on project keys |
| Spend per key | Activity per key, 7 days free or 90 on Pro | Shown in the Usage and Spend dashboards |
Give each app or agent its own capped Keylayer key, and keep a monthly hard limit on the OpenAI project behind them as a backstop.
Cap an OpenAI key at $5 a day
- Sign in at keylayer.app with Google and set up your vault with a passkey.
- Add your OpenAI API key as a credential. You paste it into the vault window, and the dashboard never sees it.
- Mint a key. Under Limits, set Spend in dollars to 5, pick A day and choose Hard. Check Keep it in the vault, so you can edit the cap later.
- Set KEYLAYER_KEY to the new key and point the SDK at https://relay.keylayer.dev/v1.
- Change the cap any time under Edit limits. The key itself stays the same.
The quickstart walks through each screen, and the OpenAI provider page covers what each OpenAI route reserves.
Questions
Can I set a spending limit on a single OpenAI API key?
Yes, by putting a Keylayer key in front of it: that key carries a dollar cap per UTC hour, day, week or month, checked before each request. OpenAI's own hard spend limits only apply to an organization or a project, per month.
What happens when a key reaches its cap?
Keylayer refuses the request with 403 budget_exceeded before it reaches OpenAI. The error comes in OpenAI's format, so the SDK raises it like any other API error, and its retry-after header gives the seconds until the period resets. Keys with room left under their own caps keep working.
How exact is the cap?
A hard cap counts each request at its worst case before forwarding it, along with everything still running, so requests in flight can't push the key past the cap together. If OpenAI ever reports more than a reservation, Keylayer suspends the key. An estimated cap lets through calls it can't price, so spend can pass it.
Does Keylayer add a markup on OpenAI usage?
No. OpenAI bills you directly, on your own account, for everything you send. Keylayer charges only its plan: free, or Pro at $19 a month or $190 a year.
Does Keylayer store my prompts?
No. The relay reads each request to price it and forwards it, but it never stores request or response bodies. The activity trail keeps metadata: which key called which path and when, the result, token counts and cost.