Fusebox emails you before your OpenAI bill blows past a number you set. Before writing any of that code, I spent an afternoon checking one thing: what kind of API key would I actually need to ask people for?
That question mattered more than it sounds like it should. A tool that reads your spend needs some credential from your account. The honest version of that credential can only read - it can't touch billing, can't create or revoke other keys, can't add or remove people from your org. The dishonest version asks for more than it needs and hopes you don't check.
OpenAI lets you create an Admin key and restrict it to specific permissions per resource - None, Read, or Write. For usage and cost data specifically, that's a scope called api.usage.read
. Grant only that, and the key can pull your spend numbers and do nothing else. That's exactly the shape of trust a tool like this should ask for.
I checked the same thing for Claude, expecting a similar scoped option. Anthropic's own docs say otherwise, for Claude Console (the product individual developers actually use):
"Claude Console keys do not have selectable scopes; every key carries full access to all endpoints that accept Admin API keys."
Scoped read-only keys do exist on Anthropic's side (read:spend_limits
, read:analytics
) but only for Claude Enterprise organizations, not individual Console accounts. For everyone else, the only key that can read usage data can also manage your organization's members and revoke other people's API keys.
Asking a solo developer to hand that over, in service of a feature as small as "email me at 80% of my budget," is a bad trade. So Fusebox doesn't do it yet. Claude support is built and waiting - it's a small amount of code - but it stays off until Anthropic ships the same kind of scoping for individual accounts that OpenAI already has.
Most tools that ask for API access don't explain what they're actually asking for, and most users don't check. I'd rather the constraint be visible than quietly worked around.
Fusebox is free, early access, OpenAI-only for now: [https://fusebox.sifatsrk.workers.dev](https://fusebox.sifatsrk.workers.dev)
If you've found a cleaner way to do the Claude side of this safely, I'd genuinely like to hear about it in the comments.