Set Per-Team LLM Budgets with Virtual Keys

Availability first. The AI Gateway described here is released behind a feature flag and is not switched on for every ZopNight environment. If your sidebar has no AI Estate section, it is not enabled for your organisation yet, and the steps below will not be available to you.

When several teams call one provider account with one shared credential, a cloud budget can tell you the total but not which team spent it. The AI Gateway approach is to give each team its own virtual key, with its own budget and its own list of allowed models, while the real provider credential stays in one place.

1. Connect a provider

An admin connects the provider in Settings, then Integrations. Supported providers are OpenAI, Anthropic, OpenRouter and AWS Bedrock. The credential is checked against the vendor when you connect, so a revoked or mistyped key fails immediately rather than on a team’s first request. Connecting registers a small cheap-tier and strong-tier model set so keys can be issued straight away; more models can be added from the provider’s catalogue under Manage models.

Model registration is admin-only because it accepts provider credentials; the built-in Editor role can view models but not add them.

2. Issue a key per team

Under AI Estate, then Inference Keys, create a key for each team:

• Give it a hard budget in US dollars. When the key reaches it, requests on that key are refused.
• Restrict it to the models that team should use. A key rejects any model outside its allow-list.
• The key is shown once, at creation, with copy-paste snippets for Claude Code, the OpenAI SDK and cURL. Store it in the team’s secret manager.

Keys are visible to everyone in the organisation with key permissions, not just to their creator, and each records who created it. Editors can create, edit, rotate and revoke keys. Custom roles can be scoped to a single provider, for example a role that manages only Bedrock keys.

3. Add an organisation ceiling

Set the organisation budget ceiling. It caps total spend across every key, on top of each key’s own budget, which protects you from the sum of individually reasonable team budgets. You can also set a per-provider budget on the Budgets page.

4. Get alerted before the limit

Each key’s budget feeds the same notification system as cloud budgets. A warning fires at 80% of the key’s budget and an exceeded alert at 100%, naming the key. Subscribe a channel to budget events to receive them; the hard stop at the limit still applies whether or not anyone is subscribed.

5. Rotate and revoke

Rotate a key to mint a replacement and retire the old one, keeping the original creator on record. Revoke a key that a team no longer needs. Rotation needs the key update permission, so a role that can only create keys cannot destroy one by rotating it.

Check spend

AI spend appears under Cost Reports, then AI Spend, broken down by provider, model, tier and team, with the share of requests served by the cheap tier, average latency and failed-request counts. If the gateway is briefly unreachable, the page shows the data as stale rather than reporting zero.

What ZopNight sees in your requests

Requests pass through the ZopNight-hosted AI Gateway. The complexity router reads each prompt to choose the cheap or strong tier; keys, budgets and spend reporting work from per-request usage data (key, model, tokens and cost). Background: LLM cost governance and virtual keys.