Subscription vs API key: don't get billed by surprise

I had a small monthly spending limit on my AI account. One week it emptied itself in a couple of days, and for a while nobody, me included, could say why. The tool I thought was spending the money had spent about one cent. The real cause was that a handful of my own automations were quietly paying the expensive way for work my subscription already covered.

Nothing terrible happened, because the limit was low. But it taught me the difference between the two ways you pay for AI, and that difference is worth understanding before you build anything that runs on its own.

The two ways you pay

AI companies like Anthropic (who make Claude) charge in two separate ways:

• A subscription. A flat monthly fee for a person using the AI: in the app, in the browser, or in Claude Code on your computer. You sign in with your account. There are usage limits, and no per-use bill unless you switch on the option to keep going past them.
• An API key. An API (application programming interface) is how software talks to other software. An API key is a long password that lets a program use the AI, and you're billed for each use, usually by the amount of text going in and out.

The simple version: a subscription is for a person using AI, an API key is for software using AI.

This is why some things can't use your subscription. A form on your website, a chatbot that answers customers while your computer is off, anything running on a server: none of these can sign in as you. They need an API key, and they cost money per use.

Step 1: List what you have and how each one pays

Write down every AI tool and automation you use, and next to each one, which way it pays. For most founders the list is short. You might find:

• Chatting in the app: subscription.
• Claude Code on your laptop: subscription, if you signed in with your account.
• A chatbot on your website: API key.
• An automation tool calling AI on a schedule: usually API key.

If you can't say how something pays, find out before it runs again.

Step 2: Set a spending limit wherever your API keys live

Wherever you create API keys, look for a setting that caps monthly spending. On some platforms the cap sits on the account or on a project or workspace that holds the keys, not on each key, so check your tool's billing settings for where it lives. Set it low to start. A low limit turned my leak into an annoying stop instead of a large bill. You can raise it once you know what normal spending looks like.

A limit set too low has a cost too: when it's reached, everything using that key stops. So set it low enough to protect you and check it regularly.

Step 3: Keep the key away from things that don't need it

Here's what happened to me, in plain terms. The settings file that held my API key for one tool was also read by several other automations on my computer. They picked up the key and used it, so they billed my card instead of my subscription. Each of those automated sessions cost a few dollars at the per-use rate. A handful of them used up the limit.

The lesson for a non-developer: an API key in a shared settings file can be used by anything that reads that file. Keep keys only where they're needed, and if you're unsure which tools can see one, ask someone who set them up.

Two related traps:

• Fixing it doesn't fix programs already running. An automation that was started before the fix keeps behaving the old way until it's restarted. One of mine kept spending for hours after the fix was in.
• Testing it from inside an AI tool can lie. I ran a check that "proved" the key wasn't being used. The check was run from inside a tool that used my subscription no matter what, so it couldn't have failed. If you're testing how something gets billed, test it the way it actually runs.

Step 4: Remember that "included" isn't unlimited

Work on your subscription costs no extra money, but it still counts against your usage limits. If you set up automations that run on your subscription, they share those limits with you. On one day I was working heavily, a background job hit the limit and did nothing at all. Those jobs were probably also part of why I kept hitting my own limit.

Step 5: Know what a leaked key costs

If an API key ends up somewhere public or shared, such as a chat, an email, a screenshot or a file you sent someone, anyone who finds it can spend money on your account until it's switched off.

The rule I follow: if a key has been somewhere it shouldn't, cancel it and make a new one, even if it still works. You can't know who else has a copy, and "it still works" only tells you it's still usable by them too. The next guide covers how to keep keys out of those places in the first place.

Step 6: Cancel burst subscriptions when you buy them

This applies to every paid tool. I've signed up for a monthly plan for one big job more than once. The useful habit: decide the cancel date when you subscribe, and write it down. Otherwise one good week turns into a permanent monthly cost.

And when a paid tool suddenly refuses to work, check your credit or usage balance before assuming it's broken. Some tools don't tell you clearly that you've simply run out.

What to do next

Spend twenty minutes on the list from Step 1 and set a spending limit wherever you have API keys. That one setting protects you from most surprises.

Next in this track:

• Keep secrets out of your files and chats, so your keys don't leak in the first place.

If you're planning something that needs to run on its own and want to know what it'll cost before you build it, ask me for the free audit. I'll tell you which way it should pay and where the surprise bills usually come from.