By Partly fixable yourself. Set spend caps today, per-user limits need an engineer.
- How serious
- High
- Fix it yourself?
- Partly, some steps need a developer
- Typical cost
- $49–$800 one-off check, or €99–$990 for a single fix (prices)
- Top rated
- Afterbuild Labs · 10.0/10
What you see. Your OpenAI bill grows far faster than your user count, or usage keeps climbing while nobody is using the app.
Why it happens
OpenAI describes cost as a function of the number of tokens and the price per token. AI-built apps push both without anyone noticing. The chat feature sends the whole conversation history with every message, so each request grows. A component re-renders and fires the same call several times per page view. The most capable model is used for a task a cheaper one could handle.
Then there are the structural gaps. No per-user limit means one person or a script can run the feature without end. Test runs and real users share one key, so you cannot tell them apart on the usage page. And if the key is in the frontend, the usage is not even yours, see surprise bill. Without a spend limit, nothing stops any of this.
Fix it yourself
- Open the OpenAI Usage page. Look at which project and key spent the money and at what hours. A steady line overnight means scripts, bots, or a loop, not customers.
- On the Limits page set a spend alert and a hard spend limit. The hard limit stops traffic at the cap, so set it above normal use.
- Create separate projects and keys for testing and for real users, each with its own limits, so test runs stop hiding inside production numbers.
- Ask your builder: Cap AI requests per user per day, require sign-in, trim chat history to the last few messages, and set max_tokens.
- Have tokens per request logged. The API returns token counts with every response, so you can see which feature costs the most.
- Test a cheaper model for simple tasks like classification or short rewrites. Keep the strong model only where quality clearly needs it.
When to get an engineer
Get an engineer when you cannot find the feature behind the spend, when the usage line is flat around the clock, or when you need limits and logging built properly. Give them access to the usage page and a list of AI features in the app. A one-off check is $49–$800 and a single fix is €99–$990, two to four days. Ask for per-user limits, token logging, and a monthly cost report.
Top-rated companies
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Check these
AI and paid API calls have per-user limits
Without a cap, one user or one bot loop can spend your monthly budget in an hour.
Testing and real users use separate databases
Experiments and AI agents should never run against production data.
Errors reach you before users do
Add error monitoring and uptime alerts. If you learn about outages from customers, this is missing.
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Questions
Can I just switch to the cheapest model?
Sometimes. Test it on your real prompts first. The OpenAI guidance is to build with the strongest model, then try cheaper ones and compare.
Will a hard spend limit break my app?
When the cap is hit, affected requests return 429 and the AI feature stops until the next period or until you raise it. That is the point. Set it with headroom.
Sources: OpenAI: production best practices; OpenAI: rate limits and spend limits; OpenAI: best practices for API key safety.