# OpenAI bill spiked overnight: find the key, model, and endpoint that did it
## The symptom
The bill or usage dashboard jumps with no deploy you can tie to it. Attribution first, panic never.
## Confirm the cause
Triage in this order:
1. **Spend-limit scope.** `organization_spend_limit_exceeded` 429s mean every project is burning; `project_spend_limit_exceeded` means the culprit is inside one project. The scope of the trip is the scope of the hunt.
2. **Attribute by key.** Usage is tracked per API key. Find which key jumped. A leaked key used by someone else looks exactly like a spike; rotate any key you cannot account for.
3. **Attribute by model and endpoint.** Reasoning models burn hidden reasoning tokens that never appear in the response but do appear on the bill. A model swap, even an alias resolving to a newer model, can multiply cost per call.
4. **The four usual suspects:** a retry storm on 429s multiplying every failed call; a tool-call loop running dozens of turns per task; a batch or backfill someone ran and forgot; streaming retries rebilling prompt tokens each time.
## The fix
Kill the hot path first, argue later. Then add rails: org and project spend limits set to deliberate values, usage alerts before the limit, per-key tracking so the next spike names its key immediately. Rotate keys on a schedule so a leaked key has a short half-life.
## Verify the fix
Watch usage for a full day and confirm the burn rate is back to baseline. Fire a test alert against your spend threshold before trusting it in production.