Give Claude Code a spend boundary
Set up one named agent
Create your cloud workspace, then save a separate Anthropic inference key and supported model. Saving the inference key sends no model request. Register a Claude Code agent, give it a named owner and the model permissions it needs, and issue its scoped workspace key.
Check the current integration compatibility and your client version before changing configuration. Use the exact workspace gateway base address from the portal. For the Anthropic dialect, avoid adding a second /v1 suffix. Claude Code uses ANTHROPIC_AUTH_TOKEN for the gateway credential.
export ANTHROPIC_BASE_URL="<workspace-gateway-base-address>"
export ANTHROPIC_AUTH_TOKEN="<issued-workspace-agent-key>"
# Select a supported model configured for this workspace.Set a ceiling you can explain
Confirm the price table covers the model and every reachable fallback. Set per-request, rolling-hour, UTC-day or UTC-month USD ceilings on this agent as appropriate. Rates and limits must come from your own approved configuration; this guide invents no recommended spend or saving.
Under a hard ceiling, a request gets one potentially billable attempt. An unpriced reachable model is refused before egress rather than estimated at zero. Per-agent ceilings do not pool a team’s budget and do not control traffic sent directly to Anthropic.
Inspect the decision before a real workload
Synthetic example: an agent has a USD 10 daily ceiling, USD 9 reserved or recorded and a conservatively priced USD 2 proposed request. The projection is USD 11, so the request is refused before provider egress. The example is arithmetic, not a result from a customer deployment.
In your workspace, inspect the agent, timestamp, blocked outcome and typed budget reason on the trace. Read metadata first. Bounded, redacted prompt and reply capture is opt-in and cannot reveal hidden reasoning. A source-only or synthetic check does not prove your live provider key or workload is qualified.
A real permitted model call can incur provider charges. Use an approved small workload only after checking the configuration, then confirm its trace and account evidence. Restore the client configuration if you stop routing through the workspace.
The texts this guide names
Where the guide above cites a law, a standard, a specification or a paper, this is the text itself, so an article number or a field name can be checked against the original rather than taken from this page. None of it is a source for what Token Observe does; that traces to the product’s own repository. Each read on .
- Claude Code LLM gateway configuration code.claude.com
Where this argument meets an implementation
Spend controls
Hard USD ceilings, per-minute rate limits and a kill switch, all decided before the request leaves your network.
Flight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
Agent registry
One record per agent, and it is the record the gateway enforces against.
Those pages are one product's implementation of what this guide argues for, each listing what it does not do beside what it does.
How it worksCan I cap every developer’s Claude subscription?
No. A subscription seat and routed API requests have different billing. This walkthrough applies to the supported API traffic you configure through the gateway.
Does a refusal prove we saved that amount?
No. It records a blocked proposed request. The example’s upper-bound estimate is not a measured saving or a final invoice charge.
After reading it, the next step is running it on your own hardware.
Create a cloud account and workspace. No card or server installation. Model calls and Google BigQuery scans can incur separate provider charges.