How do I set a spend limit for Claude Code or Codex on my own API key?

Point your agent at the proxy

Anthropic clients take the base URL without /v1, OpenAI clients with it. Start runawayguard with the --upstream shown on each tab.

$ ANTHROPIC_BASE_URL=http://127.0.0.1:8402 ENABLE_TOOL_SEARCH=true claude

model_provider = "runawayguard"

[model_providers.runawayguard]
name = "OpenAI via runawayguard"
base_url = "http://127.0.0.1:8402/v1"
wire_api = "responses"
env_key = "OPENAI_API_KEY"

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "anthropic": { "options": { "baseURL": "http://127.0.0.1:8402/v1" } }
  }
}

# API Provider: Anthropic
Use custom base URL   on
Base URL              http://127.0.0.1:8402

# or API Provider: OpenAI Compatible, proxy with --upstream openai
Base URL              http://127.0.0.1:8402/v1

Claude Code turns MCP tool search off for any base URL other than api.anthropic.com, so ENABLE_TOOL_SEARCH=true turns it back on. Settings checked against each agent's docs or source in October 2026. Roo Code, Aider and Pi are in the README.

What happens at the limit?

The limit is checked before each request. Once it is reached, new requests to /v1/messages, /v1/chat/completions and /v1/responses get this answer, here with --limit 5, and are never sent upstream.

{
  "type": "error",
  "error": {
    "type": "spend_limit_reached",
    "code": "spend_limit_reached",
    "message": "runawayguard: $5.00 session limit reached ($5.03 spent). Restart runawayguard with a higher --limit to continue."
  }
}

Anthropic and OpenAI clients both read the body as an error. The official SDKs obey x-should-retry: false and do not retry a 402 on their own. Model lists and count_tokens still pass, and Esc in Claude Code cancels the upstream request too.

What leaves your machine?

Requests

From your agent to runawayguard on 127.0.0.1, then to the upstream you chose. The only other request fetches LiteLLM's public price list, at most once a day. --offline skips it.

API keys

Forwarded as they are. Never stored, printed or logged.

Prompts and responses

Never written anywhere. Each response is read in memory for its usage numbers, then dropped.

--log file

Time, method, path, status, model, token counts and cost per request. Nothing else.

What it does not catch

Unpriced models

A model missing from the price list is counted in tokens but adds $0 to the limit, with a notice the first time. A response without usage is not counted either. Prices are never guessed.

Requests in flight

Allowed to finish, so the total can end a little above the limit, as in the sample: $1.51 of $1.50.

Not supported yet

WebSocket transports, which it refuses, the Gemini API, Bedrock and Vertex endpoints, and batch APIs. Requests to other paths pass through unmetered.

One upstream

Each proxy forwards to one API. Run two on different ports for Anthropic and OpenAI.

Options

The proxy listens on 127.0.0.1 only and writes everything to stderr. Ctrl+C stops it and prints the summary.

Questions