Unit V · Money and limits
API keys spend real money
Most AI and cloud APIs bill by usage. A key is closer to a credit card than to a password: whoever holds it can run up your bill.
Usage billing
Usage-billed services charge for what is used, and your provider's pricing page says per what: requests, tokens, hours or gigabytes. A bug that calls the API in a loop, or a key found by someone else, turns straight into a bill.
Alerts are not caps
Many providers let you set a budget with alerts. Read what yours actually does. Google Cloud's documentation says an alerts-only budget does not automatically cap usage or spending: it sends alerts, and the services keep running and billing. For services that support it, Google Cloud also offers a spend cap budget on a project, which pauses the services once costs pass the budget until you lift the cap. Where a provider offers a hard limit, set one, and keep the alerts as well.
Habits that limit the damage
Use a separate key for each project and environment, so you can disable one without breaking the others. Give each key only the permissions it needs. Keep keys on the server, never in browser code (Unit III). Check the usage page every week while an app is new.
Words to know
- Usage-based billing
- paying for what you use
- Budget alert
- a notice when spending passes a threshold
- Hard limit
- a setting that stops usage at a threshold
- Least privilege
- giving a key only the access it needs
Sources
- Google Cloud: Create, edit, or delete budgets and budget alerts
- OWASP Cheat Sheet Series: Secrets Management
Checked October 17, 2026. Pages on other sites change; if a source no longer says what the lesson says, the source wins.