In the path.

Metered as they pass. Capped before they forward. Receipted when they return.

Receipt
Modelgpt-4.1
Tokens in1,200
Tokens out340
Cost$0.004180
Price listrpl-2026-06-01
Basismeasured
One base URL. Your own provider keys.

Setup

Live in about ten minutes.

  1. Create a workspace keyShown once, stored hashed.
  2. Connect your provider keyOpenAI or Anthropic, probed then sealed.
  3. Point your base URL at RecoveaOne line in your existing client.
Quickstart

The request path

Admission runs before your provider does.

  1. AuthenticateUnknown key, 401.
  2. ThrottleOver your limit, 429.
  3. CapArmed cap, 402. Nothing forwards.
  4. ForwardUnsealed in memory.
  5. PriceAgainst a frozen price list.
  6. ReceiptOne row, hash-chained.

Exact contract in the caps documentation.

Meter

Cost lands as the call returns.

Priced and attributed by key, project and route. Nothing to instrument.

ScopeWorkspace
Monthly cap150.00
Spent31.05
Kill switch
Spend, as it happens.

Caps

A cap answers the request itself.

Alerts are not caps. Arm a ceiling; admission refuses over it, before your provider is contacted.

Monthly cap150.00
At the cap

Both answer error.code: budget_exceeded. Branch on the code, not the status.

Status
402
429 with Retry-After
Error type
insufficient_quota
rate_limit_error
Error code
budget_exceeded
Armed, then refused.

Receipts

One row you can check without us.

Every call writes a hash-chained receipt. Re-derive it yourself. One row per request.

See the proof
paramnull

The limits, said plainly.

Designed to fail open: if the gateway degrades, traffic goes straight to your provider. The only stop is a cap you armed.

Your provider keys stay yours: sealed, bound to your workspace, never written to a log.

See it on your own traffic.

Start free

Free is cardless.