OpenAI spend limit not working? Here's why you still got charged

1. A spend alert is not a cap

OpenAI has two controls that look alike. According to OpenAI's spend limits guide, a spend alert “sends a notification; API traffic continues”. A hard spend limit makes affected requests fail with a 429 error. If you entered a monthly amount but didn't turn on “Enforce a hard limit”, you only have an alert.

2. Enforcement is not instantaneous

Even with a hard limit, OpenAI says “enforcement is not instantaneous, so recorded spend can slightly exceed the configured amount”. A fast loop or an abused key can run past the cap while the limit state propagates. One Hacker News thread describes $285 of unauthorized charges an hour after setting a $30 spend limit, and another user replied that the same thing had happened to them.

3. Organization vs project limits

• An organization hard limit applies to API traffic across all projects and returns organization_spend_limit_exceeded.
• A project hard limit applies only to that project's traffic and returns project_spend_limit_exceeded.
• OpenAI also has a separate approved monthly usage limit based on your usage tier. It is not the same as the limits you configure.

How to set it up properly

1. Organization: Organization limits → Spend → Edit spend limit → enter the monthly amount → turn on Enforce a hard limit → Save.
2. Per project: Project settings → Limits → Spend → Edit spend limit → enter an amount → enforce the hard limit. Put each agent or app in its own project so one runaway job can't take everything down.
3. Alerts below the cap: add spend alerts at, say, 50% and 80% so you hear about trouble before traffic is cut.
4. Separate keys per project, and delete keys you no longer use.

What if traffic is already blocked?

Check error.code. For the spend-limit codes, raise or remove the limit if traffic should resume. organization_usage_limit_exceeded means you need a higher approved usage limit, and credit_balance_exhausted means adding credits.

Add an independent watcher

Provider limits are monthly and can lag. A daily threshold and a spike alert (today vs. your normal day) catch a loop or a leaked key sooner. That's what KeyBark does, using OpenAI's organization Costs API with an Admin key.