Safeguard
Developer Tools•

Attribute AI spend by team with workspaces and usage reports

Split LLM API spend by team and environment using workspaces, scoped API keys and the usage and cost reports. Includes the gaps to plan around.

Safeguard Security Team
3 min read

To attribute AI spend by team, give each team and each environment its own workspace and API keys, then pull usage and cost grouped by workspace from the provider's reporting API. Add your own tags for feature level detail. The default workspace needs extra care, since it reports a null identifier.

Use workspaces as the unit of attribution

The Claude documentation describes workspaces as a way to separate projects, environments, or teams while keeping centralized billing. Each workspace can have its own members, service accounts, API keys, and limits. Keys can be scoped to a single workspace, so a key leaked from a development workspace cannot run production traffic.

The docs list three common patterns: environment separation, team isolation for cost allocation, and project based organization. The default limit is 100 workspaces per organization.

Pull the numbers

The Usage and Cost Admin API reports token usage with breakdowns by model, workspace, and service tier, and costs in USD grouped by workspace or description. Time buckets are one minute, one hour, or one day for usage, and daily only for cost. It needs an admin level credential, and workspace keys do not work there.

The docs say data typically appears within five minutes of a request completing, and that polling once per minute is supported for sustained use.

Gaps to plan for

  • Usage and costs in the default workspace show a null workspace_id, as do keys that span all workspaces. Do not put team workloads in the default workspace if you want clean attribution.
  • Priority tier costs are not in the cost endpoint. Use the usage endpoint and filter by service tier.
  • Playground usage is not tied to an API key.
  • Some platforms differ. The docs note the programmatic reporting endpoints are not currently available on one cloud marketplace offering, where you use console pages instead.

Add your own labels

Workspaces give you team and environment. For feature, customer, or task level cost, record usage fields yourself next to your own identifiers, as covered in the cost per task post. Then reconcile your totals against the provider report weekly.

Showback before chargeback

Start with showback: send each team a monthly report of its own spend and the cache hit rate. Move to chargeback only when the attribution has been stable for a few cycles and nobody is disputing it.

Control access too

Workspace roles let you decide who can create keys and who can only use the playground. Review membership regularly, since keys tied to removed users stop working in some cases and not others, depending on key type.

Quick check

Can one key serve several teams?

Some key types can span workspaces, but then attribution depends on which workspace each request names. Single workspace keys keep attribution simple.

Where do I find the workspace behind a response?

The docs say responses include an anthropic-workspace-id header with the workspace identifier.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.