The free audit
A free audit of your AI bill
Connect read-only access to your providers and coding tools. Within the hour you'll see the last 30 days of unexplained spend by key, overcharges, keys owned by people who've left and seats nobody uses. It's free at any spend size, and there's nothing to install.
No card is needed, and Free includes one audit a month.
Connect, in five minutes
Paste an admin key that reads billing, usage and key lists for each provider and coding tool you use.
Veqen reads 30 days
Every key's usage hour by hour, what each provider billed day by day, and every agent seat and the person holding it.
Your report, within the hour
Sorted into what needs action and what's worth a look, with the reason for each, and owners and admins get an email when it's ready.
A sample report
What it finds
Each line says what Veqen saw and why it flagged it, so a leak, a mistake and a theft each read as what they are. Shut-off, the evidence for a refund and the hourly checks that keep it from happening again come with the paid plans.
- A key nobody had used in 41 days billed $2,140.00 at OpenAI over nine hoursNeeds action
- Three keys belong to people who left in AugustNeeds action
- Anthropic billed $612.40 above its own rate card on nine days$612.40 to claim
- Seven Copilot seats have had no activity since September$133 a month
- prod-batch at OpenAI spent far above its usual hour, $3,904.00 over six hoursWorth a look
- Every other key and person matched what was billedAll clear
Your access
What Veqen can and can't do with it
It reads
- What each provider billed, by day and model
- Each key's usage by hour, and the list of keys with their owners and limits
- Agent seats, and each person's usage and cost
It never
- Sends a model request with your keys, which it uses only to read
- Reads prompts, code or responses
- Changes or shuts off anything, unless you later add a separate shut-off credential
To take it back
- Disconnecting under Settings › Connections deletes the billing, usage, keys and seats that connection read.
- Revoking the admin key at the provider stops Veqen reading at once.
- Shut-off access, if you added it, is removed under Settings › Protection.
What you'll need
One read-only key for each thing you use
Open any of these for the exact key to create. You only need the ones you use, and you can add others later.
Providers
OpenAIWhat to create
Create an admin key at platform.openai.com › Settings › Organization › Admin keys with only Usage API read access.
AnthropicWhat to create
In Claude Console › Keys & access, create a key with Organization scope and cost-report access. Workspace-scoped keys can't read costs; admin keys also work.
AWS BedrockWhat to create
Create an IAM user (or role key) whose policy allows only ce:GetCostAndUsage, ce:GetDimensionValues and, for per-key protection, iam:ListServiceSpecificCredentials. To split by application inference profile, activate its tag as a cost-allocation tag in Billing.
Google CloudWhat to create
Turn on the Cloud Billing export to BigQuery (standard usage cost). Create a service account with BigQuery Data Viewer on the export's dataset, BigQuery Job User on its own project and, for per-key protection, API Keys Viewer on that project, and paste its JSON key.
AzureWhat to create
Register an app in Entra ID, add a client secret, and give it Cost Management Reader on the subscription (or billing account) the Azure OpenAI resources bill to.
OpenRouterWhat to create
Create a management key at openrouter.ai › Settings › Management keys. Activity covers the last 30 days.
Fireworks AIWhat to create
Use an API key belonging to an admin of the account (fireworks.ai › Settings › API keys).
DeepInfraWhat to create
Use an API token of the account (deepinfra.com › Dashboard › API keys).
falWhat to create
Create a key with the BILLING preset at fal.ai › Keys (FULL also works).
ElevenLabsWhat to create
Use a workspace admin's API key, and the user id of the service account whose keys your apps use.
BasetenWhat to create
Use an API key of an organization admin (app.baseten.co › Settings › API keys).
Vercel AI GatewayWhat to create
Create an access token at vercel.com › Account settings › Tokens, scoped to the team.
LiteLLM proxyWhat to create
The proxy has to be reachable from the internet over HTTPS. Use its master key, which Veqen only uses to read.
DeepgramWhat to create
Use a key with the owner or admin role on the project (console.deepgram.com › API keys).
xAIWhat to create
Create a management key at console.x.ai › Settings › Management keys.
Work and coding agents
Claude CodeWhat to create
Reads with your Anthropic admin key, so connect Anthropic first. People on Claude subscriptions come in through Claude Code's OpenTelemetry.
Claude EnterpriseWhat to create
Create a key with read:analytics at claude.ai › Organization settings › API. Add read:spend_limits and write:spend_limits to push limits into Claude and answer people's requests for more from Veqen. On a Claude Team plan, send Cowork's OpenTelemetry to Veqen instead (Admin settings › Cowork).
ChatGPT EnterpriseWhat to create
Create an admin key at admin.openai.com › Credentials › Admin keys for the workspace, with Custom permissions: Enterprise analytics API set to Read. Add usage limits read and write to push limits into ChatGPT and answer people's requests for more from Veqen.
Microsoft 365 CopilotWhat to create
Register an app in Entra ID with the Reports.Read.All application permission and admin consent, and add a client secret. In the Microsoft 365 admin center › Settings › Org settings › Reports, turn off hidden names, so each license is named.
Gemini in Google WorkspaceWhat to create
Create a service account and paste its JSON key. In the Admin console › Security › API controls › Domain-wide delegation, give its client id the scope https://www.googleapis.com/auth/admin.reports.audit.readonly, and name a super admin for it to act as.
CodexWhat to create
Reads with your OpenAI admin key, so connect OpenAI first. Name only the projects your people's Codex and other agent keys are in, so production traffic stays out.
CursorWhat to create
Create an admin API key at cursor.com › Dashboard › Settings › Advanced (Cursor Enterprise).
GitHub CopilotWhat to create
Use a token of an organization owner with the manage_billing:copilot and read:org scopes.
WindsurfWhat to create
Create a service key with the Teams Read-only role in Windsurf's team settings (Windsurf Enterprise).
DevinWhat to create
In Devin › Settings › Devin API, create a service user with ViewOrgConsumption and ViewOrgMembership (the Admin role includes both) and copy the organization id. For enterprise-wide usage, leave the id blank and use ViewAccountConsumption and ViewAccountMembership. Pushing limits requires Devin Enterprise and ManageAcuLimits.
FactoryWhat to create
Use an API key of an organization manager or owner.
Augment CodeWhat to create
Create an enterprise API token with analytics access.
WarpWhat to create
Use a team admin's personal API key, and turn on Enterprise Usage Reporting in Warp's admin settings.
OnaWhat to create
Use a personal access token with billing:read_usage.
See what your keys did last month
The report is ready within the hour, at any spend size, and it costs nothing.