Use an API when software needs to call a model repeatedly, return a structured result, use tools, or operate without a person copying text into chat. API billing is normally separate from a consumer chat subscription.
The first technical decision is not the model. It is who owns the provider account, how the secret is stored, and what happens when usage exceeds expectations.
Create a dedicated project and key
Open the provider's developer console, create a project for the application, and add billing only to that project. Do not share a personal catch-all key across experiments, production, and multiple people. Use separate projects or keys so a leak can be revoked without breaking everything.
Name the owner and recovery path. If the work belongs to a company, use company-controlled identity and billing rather than an individual's personal account.
- OpenAI: create a project and key in the OpenAI platform.
- Anthropic: create a workspace and key in the Anthropic console.
- Google: begin in AI Studio or use a managed Google Cloud project.
- xAI: create a team, key, and billing controls in the xAI console.
Keep the key out of the browser and repository
A model API key is a billing credential. Store it in a server-side environment variable or secret manager. The browser should call your server, and your server should call the model provider. A key embedded in front-end JavaScript, a mobile package, a shared document, or a repository must be treated as exposed.
Limit what the server endpoint accepts. Add authentication, input size limits, rate limits, allowed model IDs, timeouts, and logging that excludes sensitive content. Rotate the key when a team member leaves or a secret handling incident occurs.
Set a budget before the first real test
Configure provider limits and alerts where available, then add application-side limits. Record tokens and tool calls per request. Reject or review unexpectedly large inputs rather than allowing one uploaded archive to become an enormous unplanned model call.
Run a first call with a lower-cost model and a tiny approved input. Confirm the response, usage fields, error handling, and billing dashboard. Then test a representative example and calculate cost per successful task, not merely cost per request.
Never ship a model endpoint whose owner, budget, and revocation path are unclear.
Primary sources