Create an API key and set a spending limit

Checked 26 October 2026 · by A.Frick · 5 min read

Create a key, keep it out of your code, cap your monthly spend and know how to switch it off, with steps for OpenAI, Anthropic and Google.

An API key is a password for your account. Anyone who holds it can run requests that you pay for. This guide shows how to get a key at three big providers, keep it safe, cap what it can cost, and switch it off.

Menus change often. The paths below come from each provider's own docs as of 26 October 2026. Where the docs stay vague, the text says so.

Before you start

• You need an account with the provider and a payment method or prepaid credit. A key without billing may work only on a free tier, if one exists.
• Decide what the key is for. One key per app or per environment (test, live) keeps damage small.
• Know the cost model. You pay per token. See prices per million tokens and the AI API prices table.

OpenAI

1. Create the key. Sign in to the OpenAI Platform and open the API keys page (platform.openai.com/api-keys). Create a new secret key and copy it. OpenAI's quickstart names no further menu path, so follow the buttons on that page. OpenAI strongly recommends an expiry date on project keys.
2. Store it. On macOS or Linux run export OPENAI_API_KEY="your_key" in your shell. On Windows PowerShell use setx OPENAI_API_KEY "your_key" and open a new terminal. The official SDKs read this variable on their own.
3. Set a hard limit. Open Project settings, then Limits. Under Spend, choose Edit spend limit, enter the Monthly spend limit, switch on Enforce a hard limit, and save. The same steps exist for the whole organization.
4. Set an alert. On the organization's limits page (platform.openai.com/settings/organization/limits) you can add spend alerts that email you at a dollar amount. Alerts warn you; they do not stop traffic.
5. What a hit looks like. Requests fail with HTTP 429 and the code project_spend_limit_exceeded or organization_spend_limit_exceeded. Enforcement lags a little, so spend can pass the limit briefly.
6. Revoke. On the API keys page, use the trash icon next to the key. A deleted key stops working at once, which can halt apps that use it.

Anthropic (Claude Console)

1. Create the key. Sign in to the Claude Console (platform.claude.com) and open the API keys page (platform.claude.com/settings/keys). Click Create key. Name it, pick an expiration, and set Linked account: yourself for a personal key, a service account for shared work. The key starts with sk-ant- and the Console shows it only once.
2. Choose an expiry. Presets are 3 hours, 1 day, 7 days and 30 days, a custom span, or Never. A short life limits the harm of a leak.
3. Store it. Set ANTHROPIC_API_KEY in your environment. The official SDKs pick it up.
4. Set your own spend limit. Open the Billing page (platform.claude.com/settings/billing). In Spend limits click Adjust limit, or Set limit if none exists, and enter an amount. It cannot exceed your tier's cap: $500 (Start), $1,000 (Build) or $200,000 (Scale) per month. Workspaces can have their own limits, but not the default workspace.
5. What a hit looks like. At your own limit, requests return HTTP 400 with the text "You have reached your specified API usage limits". At the tier cap they return 429 until the 1st of the next month.
6. Alerts. The docs I checked name no budget-alert menu. Watch the Usage page and check the Billing page for notification options.
7. Revoke. On the API keys page, Disable is reversible; Delete is permanent. Expired keys can only be deleted.

Google AI Studio (Gemini API)

1. Create the key. Open the API Keys page in Google AI Studio (aistudio.google.com/apikey) and create a key in a project. If your Cloud project is not listed, import it first under Dashboard > Projects > Import projects.
2. Restrict it. If a key shows the Unrestricted label, click Add restrictions, choose Restrict to Gemini API only, and save.
3. Store it. Set GEMINI_API_KEY (or GOOGLE_API_KEY; if both exist, GOOGLE_API_KEY wins). On macOS with zsh, add the export line to ~/.zshrc and run source ~/.zshrc. Use Google Cloud Secret Manager in production.
4. Turn on billing. On the Projects page, find your project and click Set up billing. Prepay needs a purchase of at least $5; postpay bills at month end.
5. Set a spend cap. Open the Spend page (aistudio.google.com/spend), find Monthly spend cap and click Edit spend cap. Google marks this cap as experimental. Overage of about ten minutes of usage is possible, and long jobs such as batch runs may overshoot it. For prepaid accounts, Manage auto-reload on the Billing page has a Monthly Limit field.
6. Set an alert. In the Google Cloud console open Billing, then Budgets & alerts, and Create budget. Default alerts fire at 50%, 90% and 100%. Google states that an alerts-only budget does not cap spending.
7. Revoke. Google's leak steps: create a replacement key, deploy it, disable the old key, then audit billing and usage in the Cloud console. Manage keys on the Google Cloud credentials page.

Keep the key safe

• Never in code or Git. Read the key from an environment variable or a secrets manager. Add .env files to .gitignore.
• Never in a browser or phone app. Anything shipped to users can be read. Call the API from your own server.
• Never in chats or screenshots. See what not to paste.
• One key per app. Name keys after their job so you know which one to revoke.
• Rotate. Create the new key, switch the app, test, then revoke the old key.

Spend limits and rate limits

A usage limit caps your spend. A rate limit caps requests per minute. One protects your wallet, the other shapes your traffic.

Tip: Start with a low monthly cap, such as the price of a coffee, while you test. Raise it only when a real need shows up.

Warning: If a key leaks, act first and investigate after. Revoke it, then read the usage log.

Prices and menu names change. For costs, use the cost calculator and the provider pages linked above.