Spend caps

Most gateways reconcile a budget after the fact and fail requests when it is gone. This one puts the edge before the call.

Reserve and settle

Before a request starts, the gateway estimates the prompt cost plus the output cap and reserves it against your available balance.
When the available balance cannot cover the hold, the call fails with 402 outright — this gateway never silently clamps max_tokens; it would rather refuse than truncate your output.
When the response completes it settles on the real upstream-reported usage and releases the rest; requests that never entered generation release the hold in full.

Per-key daily quota

On top of balance, each key can carry its own daily token cap, accumulated per UTC day. When the cap is reached, requests return 429 for the day and resume the next day; 0 means unlimited. It is the hard brake for a runaway agent: even with balance to spend, a single key cannot exceed its daily quota.

Disconnects

When the client hangs up mid-stream, the gateway keeps reading upstream briefly for the final usage; if it arrives, settlement uses what was actually generated. When usage cannot be confirmed, the hold stays and the request goes to manual review, settled or refunded after verification — line items are in usage records, and a timeout's worth of nothing is never billed.