What happened

Vercel’s AI Gateway, the proxy service that routes an app’s AI model calls to whichever provider is configured, now supports spend budgets and alerts. You can set a hard dollar limit on a team, a project, or a single API key (the credential your app uses to bill AI usage to your account), and the Gateway stops requests once that limit is hit.

Budgets refresh daily, weekly, or monthly, or you can set one with no refresh at all for a running total that never resets. Monthly is the default. You manage all of this from a Budgets tab in the dashboard, or from the command line. For example, vercel ai-gateway budgets set project my-project --limit 50 --refresh-period monthly caps the project named “my-project” at $50 that resets every month.

Email alerts can notify your team at 50%, 75%, and 100% of a limit. Vercel is explicit that alerts and limits are different things: “Alerts are off by default and informational: they never block requests, only the budget limit does.” You have to turn alerts on separately from setting the limit itself.

Why it matters

Five days ago, independent developer Simon Willison argued that AI vendors need to offer hard dollar caps on API access, not just rate limits, after an investigation found a market for reselling stolen AI credentials. His specific ask was a key that “stops working the moment they hit a dollar threshold.” Vercel’s API-key-scoped budget is close to exactly that, shipped in the same week.

But the feature has a gotcha that matters more than the headline. A single request can be covered by more than one budget at once, for example a project budget and a team budget above it. Vercel’s own wording: “A request can fall under multiple budgets and has to pass all of them: if any one is over its limit, the request is rejected, even when the others have room left.”

That means a tightly capped project budget can silently start rejecting requests even while the team’s overall budget still has plenty of room. If you don’t know every budget layered on top of your project, a request can start failing for a reason that isn’t visible from where you’re looking.

There’s a second gap worth knowing. “BYOK spend is not counted against budgets by default.” BYOK means “bring your own key,” using your own account with an AI provider like OpenAI or Anthropic instead of paying through Vercel’s Gateway billing. If part of your traffic runs on BYOK, a budget you think covers everything may only be watching a portion of your actual spend.

Who should care

This matters if you’re running an AI feature through Vercel’s Gateway with real usage, especially anything public-facing where a leaked key, a bot, or a traffic spike could otherwise run up an unexpected bill. It also matters if your app mixes Gateway billing with BYOK providers, since that split changes what a budget actually protects.

It matters less for a low-traffic side project on a fixed personal budget you already watch by hand. The risk this closes, a runaway bill from abuse or a spike, isn’t much of a risk if nobody but you is calling the app.

What builders should do next

Before relying on this in production, run one bounded test. Create a scratch project on Vercel, set a project budget of $1 with a daily refresh, and turn on email alerts at all three thresholds. Then send AI Gateway requests through it until you cross the limit.

Check three things when you do: whether the blocked request returns a clear error your app can catch and show a user, rather than a generic failure; how long the alert email takes to arrive relative to when the block actually happened; and whether the budget resets and starts accepting requests again exactly when the refresh period says it should. Vercel’s changelog doesn’t publish the exact error response your code receives, so you have to observe it directly rather than assume a shape for it.

Once you’ve seen that behavior on a project you can afford to break, list every budget level that could apply to your real app, team, project, and key, and confirm none of them is set tighter than you intended. A budget you forgot about is the one that will reject a request you needed to go through.

End of article