Unexpected OpenAI API charges

429  project_spend_limit_exceeded
429  organization_spend_limit_exceeded

Why it happens

OpenAI bills per token. Three things usually cause a sudden jump:

• A leaked key being used by someone else.
• A public endpoint (say /api/chat) that calls OpenAI with no login, no rate limit and no output limit, found by bots.
• Your own code calling the API in a loop: retries without a cap, a frontend effect that re-runs, or a background job that never stops.

Spend alerts only send an email; OpenAI says traffic continues. Only a hard limit makes requests fail with a 429 once the limit is reached.

Fix it by hand

1. Stop the bleeding. Open Project settings, then Limits. In Spend, choose Edit spend limit, enter a monthly amount, and turn on Enforce a hard limit. Do the same under Organization limits. OpenAI notes enforcement isn't instant, so spend can slightly exceed the amount.
2. Find the spike. Open the Usage page and filter by project and API key. Note which key, model and day the jump came from.
3. If the key or traffic isn't yours, treat it as a leak. Rotate the key now: see OpenAI API key leaked.
4. If it's your code, find every place that calls OpenAI. For each one exposed to the internet, require a logged-in user, add a per-user rate limit, and set an output cap on every request (max_output_tokens in the Responses API).
5. Look for loops. Retries need a maximum count and backoff. Frontend code must not call the API on every render. Background jobs need a stop condition.
6. Contact OpenAI support through help.openai.com if the usage came from someone else.

Stop it happening again

• Keep a hard spend limit on every project, set just above what you expect to spend.
• Use separate projects and keys for development and production.
• Never call OpenAI from the browser. Every call goes through your server, behind login and a rate limit.
• Give each key the narrowest permissions it needs.