AI provider spend limits compared: what actually stops

Which AI providers let you set a spending limit that actually stops requests? As of 2026-10-21: OpenAI (hard limits per organization and per project), Anthropic (a tier cap plus your own limits per organization and workspace) and the Gemini API (a billing-account tier cap plus an experimental per-project cap). Google Cloud, Azure and AWS budgets only alert; their quotas limit tokens per minute, not dollars. Every one of these limits acts late, and none is set per ordinary API key.

Those limits matter most in the case nobody plans for. A provider key stolen from a repository, a laptop or a third-party tool is used directly against the provider. It never passes through your gateway, so no gateway budget, allowlist or alert sees it. What stops it is whatever the provider enforces on its own account. This comparison reads each provider's documentation, opened on the same day, for exactly that.

It is the provider-side companion to LLM spend limits compared, which compares gateways. For how to set up the layers that bound a leaked key, see how to cap the damage from a stolen AI key.

The four questions

For each provider, the same four questions:

1. Does it refuse, or only notify? A notification needs a person awake to act on it. A refusal works at 3 a.m.
2. At what scope? Organization, project, workspace, billing account, deployment. The smallest hard scope decides how small a blast radius you can engineer.
3. How late does it act? Every provider counts spend after the fact. The lag is the window in which a stolen key spends freely.
4. What else stops when it trips? A cap stops everything in its scope, including your own production traffic.

OpenAI

OpenAI separates two things that are easy to confuse. A spend alert sends a notification and API traffic continues. A hard limit makes affected requests return 429: organization_spend_limit_exceeded for the organization limit, project_spend_limit_exceeded for a project limit. Both can apply to the same request. Alerts stay active when a hard limit is added, so you can be warned before the cap¹.

Limits reset with the monthly cycle, or traffic resumes after you raise or remove the limit and the change propagates. On timing, OpenAI is direct: "Enforcement is not instantaneous, so recorded spend can slightly exceed the configured amount." The guide documents no per-key spend limit; the smallest hard scope is a project¹.

What this means for a stolen key: a project key in a project with its own hard limit can spend up to that limit, plus whatever lands during the enforcement lag. An organization-wide key with no project limit is bounded only by the organization limit.

Anthropic

Anthropic has two layers. Each of the Start, Build and Scale usage tiers carries a monthly spend cap ($500, $1,000 and $200,000 on 2026-10-21; the Custom tier has none). When the organization reaches the tier cap, usage pauses until 00:00 UTC on the first of the next month, and requests return 429 of type rate_limit_error with error_code enforced_spend_limit_reached and no retry-after header, so automatic retries keep failing².

Below that, you can set your own organization limit (no higher than the tier cap) and a limit per workspace. When usage reaches a limit you set, requests return 400 invalid_request_error, with a message naming the organization or workspace limit and when access resumes². Workspace spend limits are set from the Workspaces page, with alerts at thresholds you choose; they cannot be set on the Default Workspace, and organization limits apply even if workspace limits add up to more³.

Two details shape blast radius. Keys can be scoped to a single workspace, so a workspace limit bounds what a workspace key can spend. And the Claude Code workspace, which Anthropic creates when members sign in to Claude Code, is the only workspace that supports per-user monthly spend limits³. Anthropic's pages do not state how quickly a spend limit takes effect.

Google Gemini API

The Gemini API (AI Studio keys on generativelanguage.googleapis.com) enforces a monthly cap per billing account, set by usage tier: $250 at Tier 1, $2,000 at Tier 2, and $20,000 to $100,000 or more at Tier 3 on 2026-10-21. Spend is aggregated across every linked project with the Gemini API enabled, and when the account reaches its tier cap, "service is paused for all projects linked to that billing account until the start of the next billing cycle"⁴.

Since March 2026 you can also set a project spend cap in AI Studio, a monthly dollar limit per project that stays on until you change it⁵. Google labels the feature experimental and limited in scope, says caps are not available for invoiced (offline) accounts, and warns that billing data can take around ten minutes to process, so a project can go over its cap⁴. Google's announcement puts it plainly: "users are responsible for overages incurred during that period"⁵.

Google Cloud (Vertex AI and everything else)

Google Cloud budgets are alerts. Google's documentation says an alerts-only budget "doesn't automatically cap Google Cloud or Google Maps Platform usage or spending", that it may take several hours before the first notification, and that there is a delay between using resources and the costs reaching Cloud Billing⁶.

There are two ways to turn alerts into a stop, both blunt:

• Disable billing from a budget notification. A budget can publish to Pub/Sub, and a Cloud Run function can call the Cloud Billing API to remove billing from the project. Google warns that this terminates all services in the project, that "resources might be irretrievably deleted", that recovery is not guaranteed, and that the setup "doesn't guarantee that you won't spend more than your budget"⁷.
• Lower API quotas. You can cap requests per day or per minute on a billable API from its Quotas tab. Google notes that these caps "regulate individual API volumes rather than overall spending", that enforcement has a latency after a threshold is passed, and that short spikes are permitted⁸.

Azure OpenAI

Azure budgets notify. Microsoft's tutorial says: "Resources aren't affected, and your consumption isn't stopped." Cost data is typically available within 8 to 24 hours, budgets are evaluated against it every 24 hours, and emails normally go out within an hour of an evaluation. At subscription and resource-group scope a budget can call an action group, which can run automation⁹.

The control in the request path is quota: tokens per minute assigned to each deployment, up to a limit per subscription, region and model. Over it, requests get 429 until the minute's counter resets¹⁰. That bounds the rate a stolen key can spend at, not the total; a deployment allowed a high rate can still spend for hours before a budget email arrives.

Amazon Bedrock

AWS Budgets notify on actual or forecast cost. Budget information is updated up to three times a day, typically 8 to 12 hours apart, and AWS warns that you may incur costs beyond the threshold before you are notified¹¹. A budget action can run automatically or after approval when a threshold is crossed: apply an IAM policy or a service control policy, or target specific EC2 or RDS instances¹². A deny policy on the identity a key belongs to is the nearest AWS equivalent of a stop, and it fires on the same delayed data.

In the request path, Bedrock enforces service quotas per model and Region: tokens per minute (input and output combined), a cross-model maximum of tokens per day per account and Region, and requests per minute for some models¹³. Like Azure's, these bound rate, not dollars.

Side by side

Four things the table does not show

No provider documents a dollar limit per ordinary API key. The smallest hard scope is a project or workspace. To bound one key, give its workload a project or workspace of its own and put the limit there. Anthropic's per-user limits exist only in the Claude Code workspace³.

A limit reached by a thief stops you too. Anthropic pauses the organization until next month at the tier cap²; the Gemini tier cap pauses every project on the billing account⁴. A stolen key that runs to the cap turns a billing incident into an outage of your own production traffic in the same scope. Separating experiments, agents and production into their own projects or workspaces, each with its own limit, keeps one leak from exhausting the room the others need. Whether a separate billing account is worth it for Gemini production traffic is a judgement for your team; the documentation only says the tier cap is account-wide.

Lag is exposure. Every provider counts spend after the fact. The shorter the lag and the lower the limit, the smaller the window. A monthly limit set at three times normal spend, with a ten-minute or multi-hour lag, still leaves room for a large bill.

Rate limits are not spend limits, but they help. Azure quotas and Bedrock quotas cannot stop a total, but a deployment or model quota set close to what the workload needs bounds how fast a stolen credential can spend while the budget data catches up¹⁰¹³.

A provider-limit checklist

• Every provider account has a hard limit where the provider offers one: OpenAI organization and project limits, Anthropic organization and workspace limits, Gemini project caps where your account type allows them.
• Production, agents, evaluations and experiments live in separate projects or workspaces, each with its own limit.
• Limits sit above normal monthly spend with headroom, and below the amount that would hurt.
• Spend alerts fire well before each hard limit, to people who can act.
• On Google Cloud, Azure and AWS, budgets alert on forecast as well as actual cost, and the stop you would use (billing disable, a deny policy, a quota cut) is written down and rehearsed.
• Quotas on Azure deployments and Bedrock models sit near what each workload needs, not at the maximum granted.
• Someone reviews provider usage per key or per project weekly; see how to detect traffic that bypassed your gateway.

Provider limits and INFRO budgets

INFRO is an AI control plane in front of the provider accounts you connect. Its budgets per organization, project, member and key are checked before the provider is called, and a request that does not fit is refused with 402. That acts earlier than the provider limits above, because it does not wait for billing data, though it counts INFRO's estimate of provider cost rather than the provider's bill. But it governs only traffic that goes through INFRO.

A provider key stolen from anywhere, including from a platform like INFRO that holds customers' provider keys, can be used directly against the provider. Every INFRO budget, allowlist and alert is bypassed. For that case the provider's own limits, scoped keys, revocation at the provider and usage monitoring at the provider are the backstop, which is why this page exists. On the Business plan, INFRO's reconciliation reads OpenAI's and Anthropic's own cost reports with a separate admin credential and, with usage access on, can name traffic on your provider keys that did not go through INFRO. Without usage access it reports that check as not done, never as clean.

Set the provider limit above the gateway's organization budget, so the gateway refuses first in normal operation and the provider limit only ever trips on traffic the gateway never saw.