Show HN: Veqen – Catch a leaked AI API key by its spend, within the hour

Veqen launched as a tool that detects a leaked AI API key by its spending pattern, reading per-key usage every fifteen minutes from OpenAI, Anthropic, Fireworks AI, fal and Baseten on paid plans and flagging anomalies such as a key woken after a month unused or an hour far above its usual, usually within the hour. Veqen connects with read-only admin keys and requires a separate shut-off credential under Settings › Protection before it can disable a key, and it reads only billing, usage and key lists — requests, token counts, models and costs — with no field for prompts, responses or code. The service also aggregates spend across work and coding agents including Claude Code, ChatGPT Enterprise, Cursor, GitHub Copilot and Devin, and files overcharge claims against providers, taking no share of credits won back.

Do I have to change any code? Not for the audit or work and coding agents, which connect with read-only admin keys. To see cost per customer or feature in your own product, add the SDK, which is two lines around the AI client you already use. Can Veqen change anything in my accounts? Only once you add a separate shut-off credential under Settings › Protection, and Veqen uses it only to turn a key off or back on, when a person asks or a policy you set says so. Where a provider can only delete keys for good, Veqen asks first every time and never deletes by policy. The keys you connect for reading change nothing, and every shut-off is logged. Does Veqen see prompts or code? No. From providers and agents it reads billing, usage and key lists: requests, token counts, models and costs. The SDK sends the same usage fields and the tags you set, and has no field for prompts, responses or code. How fast do you catch a stolen key? On paid plans Veqen reads per-key usage every fifteen minutes from OpenAI, Anthropic, Fireworks AI, fal and Baseten. A key woken after a month unused, a model it has never run, or an hour far above its usual is flagged as soon as the provider reports that hour, which is usually within the hour. Spend that only shows up against your own tracked calls waits two hours for those calls to arrive. At other providers Veqen watches the key list and its totals. Owners, admins and security members get the alert by email, Slack or webhook as soon as it's flagged. What does "AI spend watched" mean? What your AI providers bill, whether or not your code uses the SDK. For each provider Veqen takes what it billed or what Veqen tracked from your calls, whichever is more. It sets your product inference price, and requests themselves are never charged for. How is an active person counted? Anyone who used a connected work or coding agent during the billing period. Someone who holds a seat but never used it isn't counted, and shows up under Seats as money you could save. Can I buy only the work and coding agents product? Yes. Work and coding agents works without the SDK, and product inference works without any agent connected. When you use both, the whole subscription is 15% off. What do I get if Veqen finds an overcharge? A claim with the day-by-day evidence the provider asks for: what it billed against its own usage report priced at its rate card, which Veqen checks wherever a provider reports both, today OpenAI and Anthropic. Overcharge checks and claims come with every paid product-inference rung, Veqen takes no share, and every credit you win back is yours, recorded as a provider credit that the month-end close counts. Which providers and tools are supported? Billing and per-key usage by the hour, which every protection rule reads: OpenAI, Anthropic, Fireworks AI, fal and Baseten. Billing, or key lists and their totals, for the rules about the keys themselves: OpenRouter, DeepInfra, ElevenLabs, LiteLLM proxy, Vercel AI Gateway, Deepgram, xAI, Google Cloud and AWS Bedrock. Billing alone: Azure. For work and coding agents: Claude Code, Claude, ChatGPT Enterprise, Microsoft 365 Copilot, Gemini in Google Workspace, Codex, Cursor, GitHub Copilot, Windsurf, Devin, Factory, Augment Code, Warp and Ona by API, Kiro, Amazon Q Developer, Amp, Gemini Code Assist, JetBrains AI, Tabnine, GitLab Duo, Sourcegraph Cody and Replit Agent from their exports, and agents such as OpenCode, Aider and Cline from the keys they run on. The SDK prices over 2,000 models, and models on your own GPUs at the price you give them. How is this different from my providers' own dashboards and spend caps? Each provider and agent shows its own spend, and some now cap it per project or person, all inside their own product. None of them sees the others, so none gives one bill per person across ChatGPT, Claude Code, Cursor and Devin, and none can tell your traffic from someone else's on the same key. Veqen covers every provider and agent in one place, works key by key and hour by hour, catches spend nobody on your team made while it's still small, shuts off only that key, checks each bill against the provider's own rate card, and books the month for your accountant.