When AI spend spikes, contain first, then locate. Lower or pause the affected workspace, find which workspace, key, and model drove the jump using the usage report, check cache reads and reasoning tokens for what changed, identify the change or loop behind it, and add a guardrail so it cannot recur silently.
Step 1: Contain
If spend is still climbing, act before you investigate. Options, from least to most disruptive:
- Lower the spend limit on the affected workspace.
- Pause batch jobs and backfills.
- Rotate or revoke the suspect API key.
- Disable the feature behind a flag.
Remember that a limit you set returns an HTTP 400 once reached, and the tier cap returns a 429 with no retry-after header. Make sure your app degrades gracefully.
Step 2: Locate
Use the provider's usage and cost reporting to narrow it down. The Claude Usage and Cost Admin API can group by model, workspace, and API key, with hourly buckets for usage and daily buckets for cost. Data typically appears within about five minutes. Ask:
- Which workspace jumped? Which key inside it?
- Which model? Did traffic move to a more expensive one?
- Which service tier or speed setting?
- When did it start? Match that hour to deploys and config changes.
Usage in the default workspace reports a null workspace identifier, which is one more reason to keep real workloads in named workspaces.
Step 3: Decompose the tokens
Split the jump into its parts:
- Cache reads fell, cache writes rose. A prompt or tool change broke the prefix, so every request pays a write.
- Output rose. Longer answers, more tool calls, or a higher effort setting.
- Reasoning share rose. Thinking tokens are part of billed output.
- Requests rose. A retry storm, a loop, a new caller, or a leaked key.
- Input per request rose. History growing without trimming, or a larger document.
Step 4: Find the cause
Common culprits are an unbounded agent loop, a retry layer stacked on another retry layer, a prompt edit that put a timestamp near the top, a model or effort default changed by an upgrade, a job rerun without idempotency, and a credential exposed in a repository or log. If requests arrive from an unexpected source, treat it as a security incident and rotate the key.
Step 5: Prevent a repeat
- Add an alert on cost per task and on cache hit rate.
- Cap loops and per task tokens.
- Put experiments in a workspace with a low limit.
- Pin effort and model explicitly.
- Write down what happened and which metric would have caught it earlier.
Step 6: Talk to the provider if needed
If you believe billing is wrong, gather request IDs, workspace IDs from the response headers, and the usage report extract before you contact support.
Quick check
Should I rotate keys during every spike?
Only if the traffic source is unexplained. If it is your own loop or deploy, fix and limit that instead.
How fast does the usage report update?
The docs say data typically appears within about five minutes of a request completing, though delays can be longer.
Sources
Last reviewed: 19 October 2026.
