---
title: "Cap a leaked key | Recovea"
description: "A leaked key spends into a ceiling you set in advance — on the workspace, or on that one key."
canonical: "https://recovea.ai/use-cases/cap-a-leaked-key/"
source: "https://recovea.ai/use-cases/cap-a-leaked-key/"
---

![](https://recovea.ai/media/gallery/gallery-sahara-dunes-1600.webp)

# For the key that gets out.

A stolen key inherits a ceiling, or carries its own. It raises neither.

[Start free](https://platform.recovea.ai/signup)

Free is cardless.

Works with the providers you already call:

- OpenAI
- and any OpenAI-compatible endpoint

The blast radius is decided in advance.

## Set the ceiling first

Alerts are not caps. Arm a cap on the workspace, or on the key itself. Spend lands inside it — enforced live, on the next request.

[The 402 contract](https://recovea.ai/docs/products/cap/)

![](https://recovea.ai/media/gallery/gallery-new-england-in-fall-800.webp)

Monthly cap150.00

At the cap

Block (402)Pause (429 with Retry-After)

Both answer error.code: budget_exceeded. Branch on the code, not the status.

- **Status**
  402
  429 with Retry-After
- **Error type**
  insufficient_quota
  rate_limit_error
- **Error code**
  budget_exceeded

## Every request names its key

Spend is attributed to the key that made it. Traffic you did not send shows up while it happens, not on the invoice.

[The request path](https://recovea.ai/product/)

![](https://recovea.ai/media/gallery/gallery-utah-red-rock-800.webp)

API keyRequestsSpend

rcv_live_4a7131,972$1,535.10

rcv_live_0c9313,102$1,219.23

rcv_live_b8e26,225$548.97

rcv_live_2f6010,454$263.11

rcv_live_d51714,994$76.17

Total$3,642.58

## End it from one place

Your provider key never travels. Rotate or revoke a gateway key in one place — the deploys never held it.

[How keys are held](https://recovea.ai/trust/)

![](https://recovea.ai/media/gallery/gallery-tropical-jungle-800.webp)

Gateway keys

Nameagents

Keyrcv_live_b8e2

RotateRevoke

The old key still works for 60 minutes

RevokedIts requests stop at the door.

Four things happen on every call:

### Meter

Live

Sample month

- claude-sonnet-4-5$42.41
- gpt-4.1$31.01
- claude-haiku-4-5$12.84
- 3 more models$4.05

Today$90.31

Every call is priced as it happens, and booked to the key that made it.

Point one base URL at Recovea and the meter starts. Every call is costed against a frozen price list. Your keys, your provider accounts and your code stay unchanged.

[Start free](https://platform.recovea.ai/signup)[View docs](https://recovea.ai/docs/)

Free is cardless.

### Cap

Armed

Sample month

Workspace · August $3,642.58 of $4,000.00

Agent runner · daily $199.98 of $200.00

- claude-sonnet-4-5/v1/messages22:50:20402

insufficient_quota

An armed cap sits in the request path, so the call that would cross it is refused before it is forwarded.

Set a ceiling and arm it. The next call over the line is refused with a 402 your code can branch on. The kill-switch is the second brake, on every plan.

[Stop a runaway agent](https://recovea.ai/use-cases/stop-runaway-agent/)

### Breaker

Run

Sample month

run_b3b6…4b87 Declared $240.00

$239.98 spent

- /v1/chat/completions402

budget_exceeded

A Recovea Breaker is a budget one run carries: $240.00. It trips at that line, and stays tripped until a person starts a new run.

Only the calls that name a run in a header carry a Breaker. It tightens the caps above it, never loosens them, and stops that run, not your key and not the runs beside it.

[View docs](https://recovea.ai/docs/products/breaker/)

### Prove

Ledger

Sample month

1. claude-sonnet-4-522:50:14b502…1f15
2. claude-sonnet-4-522:50:1683f2…19ce
3. claude-sonnet-4-522:50:18f4be…4849

Export

Every call writes a receipt into a hash-linked chain that anyone can check without trusting us.

A receipt is written for every call, on every plan, Free included. The chain is published with its recipe, so you can export it and re-derive every hash in your own browser.

[See the proof](https://recovea.ai/proof/)

## FAQ

What does a cap not reach?

A cap bounds what routes through the gateway, at either scope. A provider key used directly never enters the path.

What happens if Recovea goes down?

Designed to fail open: if the gateway degrades, traffic goes straight to your provider. The only stop is a cap you armed.

Who holds my provider keys?

Your provider keys stay yours: sealed, bound to your workspace, never written to a log.

Do I have to change my code?

One line — the base URL. The gateway serves the wire format your client already calls.

Is there a free trial?

14-day free trial, card required. Free is cardless.

How many people can use it?

Unlimited seats on every plan.

- [September 2, 2026Recovea BreakerA spend budget one run carries, declared in a request header.](https://recovea.ai/changelog/recovea-breaker/)
- [August 30, 2026Caps on a Single API KeyA budget scoped to one API key, enforced in the request path.](https://recovea.ai/changelog/caps-on-a-single-api-key/)
- [August 29, 2026One Base URLOpenAI and Anthropic wire formats on a single base URL.](https://recovea.ai/changelog/one-base-url/)
- [August 5, 2026A New Plan LadderFour self-serve plans replaced the previous ladder: Developer, Team, Growth and Scale.](https://recovea.ai/changelog/a-new-plan-ladder/)

[Changelog](https://recovea.ai/changelog/)

## Set the ceiling today.

Caps up to $1,000/mo on Free — Developer raises the ceiling to your full band.

[Start free](https://platform.recovea.ai/signup)

Free is cardless.