Give each customer a dollar line on your own provider keys. At the line, that customer’s next request is refused before your provider is called.
Start freeFree is cardless.
Works with the providers you already call:
One customer stops. The rest keep going.
Tag each request with your customer’s id, and one rule gives each customer a cap of its own: a dollar line at the price-list version named on every receipt, kept current for the models you run.
The setup guide
Sample month
Every response served under an armed line carries what is left of it, so your app can warn that customer first. At the line, the refusal is a 402 your app can act on.
The 402 contract
Spend is booked to the customer each request names, as it is to the key that sent it. Each refusal is kept in the record.
Customer spending caps
Four things happen on every call:
Sample month
Every call is priced as it happens, and booked to the key that made it.
Point one base URL at Recovea and the meter starts. Every call is costed against a frozen price list. Your keys, your provider accounts and your code stay unchanged.
Free is cardless.
Sample month
An armed cap sits in the request path, so the call that would cross it is refused before it is forwarded.
Set a ceiling and arm it. The next call over the line is refused with a 402 your code can branch on. The kill-switch is the second brake, on every plan.
Sample month
A Recovea Breaker is a budget one run carries: $240.00. It trips at that line, and stays tripped until a person starts a new run.
Only the calls that name a run in a header carry a Breaker. It tightens the caps above it, never loosens them, and stops that run, not your key and not the runs beside it.
Sample month
Every call writes a receipt into a hash-linked chain that anyone can check without trusting us.
A receipt is written for every call, on every plan, Free included. The chain is published with its recipe, so you can export it and re-derive every hash in your own browser.
An unpriced request counts toward the line at a floor, from its size at the price list’s lowest input rate, never at its real cost.
Yes. The line stops the next request, so a customer’s total can end above it by what was already running. A request can still be served after a refusal while the gateway catches up, so a customer can end above its line by more than one request.
Its body is neither forwarded nor kept. The refusal is kept in the record, outside the receipt chain.
Designed to fail open: if the gateway degrades, traffic goes straight to your provider. Armed caps refuse rather than guess; so does a kill switch the gateway can read.
Under an armed line, the request is refused with a 503 and a Retry-After, never a 402. Retry it.
Under an armed line, 10,000 distinct customers per organization per calendar month. A new customer past that is refused with a 402, code customer_cardinality_exceeded, before anything is spent, unless it has an override of its own.
Customer spending caps are Team and above. On Free, your organization keeps the count of customers tagged this month and what they cost in total.
You install Recovea beside the provider client you already use. Its base URL becomes Recovea’s, its key becomes your Recovea key, and each call carries your customer’s id in a tag.
14-day free trial, card required. Free is cardless.
Unlimited seats on every plan.