A stolen key inherits a ceiling, or carries its own. It raises neither.
Start freeFree is cardless.
Works with the providers you already call:
The blast radius is decided in advance.
Alerts are not caps. Arm a cap on the workspace, or on the key itself. Spend lands inside it — enforced live, on the next request.
The 402 contract
Both answer error.code: budget_exceeded. Branch on the code, not the status.
Spend is attributed to the key that made it. Traffic you did not send shows up while it happens, not on the invoice.
The request path
Your provider key never travels. Rotate or revoke a gateway key in one place — the deploys never held it.
How keys are held
The old key still works for 60 minutes
RevokedIts requests stop at the door.
Four things happen on every call:
Sample month
Every call is priced as it happens, and booked to the key that made it.
Point one base URL at Recovea and the meter starts. Every call is costed against a frozen price list. Your keys, your provider accounts and your code stay unchanged.
Free is cardless.
Sample month
An armed cap sits in the request path, so the call that would cross it is refused before it is forwarded.
Set a ceiling and arm it. The next call over the line is refused with a 402 your code can branch on. The kill-switch is the second brake, on every plan.
Sample month
A Recovea Breaker is a budget one run carries: $240.00. It trips at that line, and stays tripped until a person starts a new run.
Only the calls that name a run in a header carry a Breaker. It tightens the caps above it, never loosens them, and stops that run, not your key and not the runs beside it.
Sample month
Every call writes a receipt into a hash-linked chain that anyone can check without trusting us.
A receipt is written for every call, on every plan, Free included. The chain is published with its recipe, so you can export it and re-derive every hash in your own browser.
A cap bounds what routes through the gateway, at either scope. A provider key used directly never enters the path.
Designed to fail open: if the gateway degrades, traffic goes straight to your provider. The only stop is a cap you armed.
Your provider keys stay yours: sealed, bound to your workspace, never written to a log.
One line — the base URL. The gateway serves the wire format your client already calls.
14-day free trial, card required. Free is cardless.
Unlimited seats on every plan.