OpenAI bill spiked overnight: find the key, model, and endpoint that did it

TL;DR: An unexplained usage jump is always some code path burning tokens on your behalf. Triage in order: spend-limit scope, then key, then model and endpoint, then the four usual suspects. Attribution first, panic never. Confirm the cause Triage in this order: 1.

The symptom

The bill or usage dashboard jumps with no deploy you can tie to it. Attribution first, panic never.

Confirm the cause

Triage in this order:

1. Spend-limit scope. organization_spend_limit_exceeded 429s mean every project is burning; project_spend_limit_exceeded means the culprit is inside one project. The scope of the trip is the scope of the hunt.
2. Attribute by key. Usage is tracked per API key. Find which key jumped. A leaked key used by someone else looks exactly like a spike; rotate any key you cannot account for.
3. Attribute by model and endpoint. Reasoning models burn hidden reasoning tokens that never appear in the response but do appear on the bill. A model swap, even an alias resolving to a newer model, can multiply cost per call.
4. The four usual suspects: a retry storm on 429s multiplying every failed call; a tool-call loop running dozens of turns per task; a batch or backfill someone ran and forgot; streaming retries rebilling prompt tokens each time.

The fix

Kill the hot path first, argue later. Then add rails: org and project spend limits set to deliberate values, usage alerts before the limit, per-key tracking so the next spike names its key immediately. Rotate keys on a schedule so a leaked key has a short half-life.

Verify the fix

Watch usage for a full day and confirm the burn rate is back to baseline. Fire a test alert against your spend threshold before trusting it in production.

When to use this

• This covers exactly what the title says: OpenAI bill spiked overnight.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with OpenAI; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current OpenAI behavior.

OpenAI documents enforced monthly spend limits at organization scope (applies across all projects) and project scope, with distinct 429 codes when each trips, plus the OpenAI-assigned usage limit. Spend limits turn an unbounded spike into a paged alert, and retrying past them never restores access (https://platform.openai.com/docs/guides/error-codes, https://platform.openai.com/docs/guides/rate-limits).