Shared Credentials and the Spend Attribution Breakdown Problem

Shared Credentials and the Spend Attribution Breakdown Problem.

Why AI spend has become impossible to explain, not just hard to manage

Enterprise generative AI spend more than tripled in a single year, going from $11.5 billion in 2024 to $37 billion in 2025 nx1.io dev.to AI data center - Wikipedia. The bill got bigger fast, and so did the pressure to explain where it went nx1.io dev.to AI data center - Wikipedia. AI costs are now the fastest-growing line item on most cloud bills, up 47% year-over-year according to Finout's analysis, and also the hardest one to break down finout.io Mavvrik.

The billing model that produced this shift changed too, and fast, driving the pricing changes described below. Between June 2025 and June 2026, every major AI coding platform dropped flat-rate pricing for some form of metered, consumption-based billing: Cursor made the move in June 2025, Windsurf shifted its credit system in March 2026, and GitHub Copilot followed in June 2026. Teams that used to pay one predictable number each month now face a bill that swings with usage, and somebody has to explain the swing.

That job has landed squarely on FinOps desks FinOps Foundation FinOps Foundation. The FinOps Foundation's State of FinOps 2026 survey, covering 1,192 practitioners managing $83 billion in combined annual cloud spend, found 98% now handle AI spend as part of their job, up from just 31% two years before FinOps Foundation. Attribution is the core of the role now, not a side project. It's the core of the role.

Yet the ability to explain the number hasn't kept pace with the obligation to explain it. Gartner's 2025 CFO survey found 54% of organizations can't state their total AI spend accurately, because the costs fragment across budgets before anyone can trace them back. The bill shows up every month, reliable to the cent. Whether anyone inside the company can say who caused it is a separate question entirely, and increasingly the harder one. The agentic shift made this worse: AI agents consume 5–30x more tokens per task than standard chatbots, and per-developer token consumption rose approximately 18.6 times in nine months per Jellyfish's research, largely attributable to agentic features kalinga.ai.

What the provider records, and what it leaves out

Providers bill the credential that made the call, not the person, team, or feature behind it. That's the root of the problem, and it holds true across every major model provider, just to different degrees.

Anthropic and Cursor give the most out of the box, with cost breakdowns down to the API key or individual developer. OpenAI sits in the middle: some breakdown comes standard in billing, and developer-level visibility is reachable through supplemental APIs, but it takes extra engineering work to get there. AWS Bedrock has historically been the thinnest of the three. Costs arrive as marketplace purchases, telling you the model and the account and not much else, though AWS rolled out IAM-principal-based cost attribution in April 2026, which finally makes per-caller visibility possible through CUR 2.0.

AWS Bedrock costs come through as marketplace purchases, giving only model and account-level detail, since developer-level attribution was previously unavailable. Tags for team, environment, or cost center, the kind of metadata that makes a normal cloud bill sortable, simply doesn't exist natively in AI billing data. Anthropic tried to close part of that gap with its Enterprise Analytics API, launched in May 2026, which adds per-user attribution. Even that stops short of per-request granularity.

None of this is a knock on the providers. Their tools answer a narrower question well: how much did we spend with this provider, in total, this month. What they can't answer is which team, which workflow, or which feature caused any individual charge. Answering that requires metadata the provider was never given in the first place, which is where sharing a single key across teams, workflows, and features actually causes trouble.

How a shared API key makes the attribution gap structural rather than incidental

When 50 engineers across five teams share one API key, the invoice that comes back is accurate in total and useless in detail. That's what happens whenever one credential fronts for many callers, not a bug in the provider's billing system. It's what happens whenever one credential fronts for many callers.

There are four common places where the ownership trail actually breaks. The application sends the provider a prompt and a model name, and nothing that says who asked for it. The gateway might attach metadata, but the router or the agent runtime downstream doesn't carry it forward. Async hops rewrite the payload and drop the original request's context along the way. And billing data lands in one system while trace data lands in another, with no shared key to join them back together.

A spike appears in Anthropic or Bedrock usage, the platform team confirms it came through the shared gateway, and then the trail goes cold. Nobody can say whether the spike belongs to support automation, an internal coding copilot, or a customer-facing product. And the damage isn't proportional to how often this happens. If just 8% of requests arrive missing team or project fields, the total bill stays accurate while the internal chargeback built on top of it is simply wrong, and wrong in a way that's hard to catch after the fact dev.to.

Agents make the fan-out version of this problem worse. One user action might trigger a gateway call, a router decision, an agent loop, a queue, and three separate model providers before it's done. Getting the total bill was never the hard part. Explaining who owns each slice of it is.

There's a security angle buried in here too, and it's not a minor one. A shared credential means an agent's failure becomes an attribution failure at the same time, because there's no way to prove what any given agent was actually authorized to do when the key covers dozens of agents at once. The fix suggested in a GitHub Community discussion from April 2026 is blunt but sound: treat a shared service credential as transport only, and require a separate decision record for every agent or tool action taken under it.

And this isn't an edge case. A Guild.ai article found that 91.5% of MCP servers in the official registry run on static API keys, personal access tokens, or no authentication at all, rather than OAuth Zylos Research Gartner. Most AI infrastructure, in practice, still runs on exactly the credential model that makes clean attribution impossible Zylos Research Gartner.

Uber is the case study everyone in FinOps circles points to FinOps Foundation FinOps Foundation. The company rolled AI coding tools out to roughly 5,000 engineers in late 2025 and burned through its entire 2026 AI budget by April nx1.io dev.to. That's what ungoverned, shared-credential spend looks like once it hits production scale, not a hypothetical.

Why ownership metadata has to travel with the request, not arrive with the bill

The FinOps Foundation's State of FinOps report found 63% of respondents were already managing AI spend, and the priority those teams named wasn't cutting costs. It was getting attribution right first FinOps Foundation. That ordering matters. You can't optimize spend you can't trace.

The fix is to treat cost attribution as a data contract rather than something bolted on after the invoice lands. Every LLM request should carry the same ownership envelope from the moment a user triggers it to the final call that hits the provider. In practice, that means a handful of fields riding along with every single request: a trace_id that ties the whole chain together across gateway, router, workers, and provider logs; an owner_team field naming who's accountable for the spend; a workflow_id marking which product path triggered the call; a feature field for finer detail, like ticket-triage versus draft-reply; a hashed tenant_id or customer_id_hash for customer-level ownership without exposing anything sensitive; and the provider, model, and service_tier fields needed to calculate cost accurately in the first place.

If a field is going to matter during a chargeback review, it needs to exist before the very first gateway hop. It shows up in a worker log somewhere downstream only later, and it will be missing exactly when it's needed most.

OpenTelemetry baggage is a reasonable way to carry this envelope, since it's built to propagate key-value context across service boundaries without much fuss. The discipline that matters more than the tool, though, is keeping those keys stable and boring, and keeping credentials and sensitive data out of them entirely. A September 2026 guide from ascendingdc.com adds a useful caution here too: don't stuff sensitive customer content into tags just to make a spend report easier to read on a dashboard. Stick to stable internal identifiers, and keep billed totals clearly separated from request-level estimates so nobody mistakes one for the other.

The FinOps Foundation's data shows 73% of enterprises blew past their original AI cost projections, and a good part of that comes down to treating attribution as something to figure out after the bill arrives, instead of a contract designed into the system from the start.

The four attribution patterns teams use, and which one holds up under review

A single shared API key per environment is the fastest to stand up and gives essentially zero visibility into which team or feature owns any given cost; it doesn't survive a chargeback review. A separate API key per team is a step up, giving cleaner coarse-grained allocation, but it breaks the moment one workflow spans multiple teams or shares infrastructure, which happens constantly once agents are involved. Project or workspace segmentation by product area tightens up budget control somewhat but is still weak once someone needs to settle a per-request dispute or trace a multi-tenant flow. Metadata attached only at the gateway is a useful first join point, but it tends to vanish the moment a request passes through a queue or an agent hop downstream.

The only pattern that actually holds up is end-to-end tracing paired with the ownership contract described above, running per-request and per-team and per-feature, all the way through.

What broken attribution looks like in a live trace is more common than most teams admit. The gateway logs a request tagged with team and feature. The router logs the provider and model. The worker logs token counts. Then the field that's supposed to join all of it, billing_join, comes back null. Token usage is visible, in other words. Who's supposed to pay for it isn't. When retries and fallback calls pile up on top of that gap, reconstructing the truth means digging through application logs and whatever anyone remembers from Slack.

Full attribution answers a very specific, very common kind of question: why did Support Automation account for 62% of yesterday's GPT spend when the API key on record belongs to Platform. That question is simply unanswerable without an ownership contract that traveled the entire path, start to finish.

The dimensions to track are user, team, model, application, and environment, with an agent or workflow identifier becoming essential the moment one request can trigger several downstream calls. Decide upfront how service accounts and missing identifiers get handled, so that unattributed usage stays visible as a flagged category rather than getting silently and incorrectly assigned to whichever team happens to be nearby.

That's the organizational cost of running on patterns that don't survive scrutiny. The dev.to/sol_causely attribution guide compares patterns. Only 39% of organizations can attribute any measurable business impact to AI spend (Deloitte, 2026), which is the organizational cost of operating on patterns that don't hold up under review.

Where an LLM gateway fits as the enforcement point for ownership metadata

An LLM gateway is a control layer that sits between applications and model providers, giving a single API surface for routing, authentication, failover, caching, cost attribution, and policy enforcement across every model call made anywhere in the company. It's the layer built to hold cross-cutting concerns so they don't end up copy-pasted into every application's own code.

That position, sitting in front of every provider call without exception, is exactly what makes it the natural enforcement point for ownership metadata. A field that doesn't exist by the time a request passes the gateway simply won't exist on the bill either.

The mechanism that makes this work in practice is the virtual key. Instead of every team sharing one raw provider credential, the gateway issues a distinct virtual key per team, workflow, or consumer group, and each of those keys can carry its own guardrail profile. A healthcare application, a coding assistant, and a customer-facing chatbot each get both the attribution metadata they need and whatever compliance controls their particular use case requires, all through the same underlying system.

This has become more urgent, not less, as provider diversity has grown. Around 37% of enterprises now run five or more models in production at once, and once you're juggling that many providers, a gateway is really the only place multi-provider attribution can get normalized into a single, coherent view elinext.com. The gateway is also where request-level telemetry that never appears in raw billing data is captured and used to enrich the picture: pulling detail from the gateway, matching it against billing data, and normalizing all of it across providers into one report.

Market numbers back up how fast this layer has moved from nice-to-have to standard infrastructure. The LLM gateway market hit $2.76 billion in 2026 and is projected to reach $7.21 billion by 2030 elinext.com. Gartner expects 40% of enterprise applications to be integrated with task-specific AI agents by the end of 2026, up from under 5% in 2025, and each of those agents fires off multiple model calls per task. That volume alone pushes the gateway from a developer convenience into infrastructure that has to hold up under sustained, concurrent, production load, attribution included.

A managed gateway, one that connects to a wide range of providers through a single unified API without demanding separate provider keys or custom integration code for each one, takes the operational weight of building this off individual engineering teams. It also keeps ownership-contract enforcement centralized in one place, rather than scattered across however many application teams happen to be calling models directly.

An alert is not a limit. A budget alert tells someone a threshold is coming up, but it doesn't stop the next request from going through. A real spending limit requires an actual policy decision about whether an operation is allowed to proceed at all, and the gateway is the only place that decision can get made before the request ever reaches the provider.

What attribution looks like when it works: from ownership contract to chargeback

The most valuable thing good attribution produces is a clean list: which requests got attributed correctly, which didn't, and which were priced wrong. It's a clean list: which requests got attributed correctly, which didn't, and which were priced wrong.

That output serves different people differently. Finance gets real chargeback or showback broken down by team, project, or cost center, instead of trying to reconstruct the month from provider invoices after the fact. Engineering gets to see exactly which product surface is burning through tokens and which model choice is driving the output-token bill up. Platform teams get to catch a runaway prompt or a batch of unattributed traffic while the month is still open, instead of discovering it during close.

Reading the output well means starting broad and narrowing down: begin with per-team totals, then drill into model, endpoint, environment, and whatever outlier requests stand out. A high input-token bill and a high output-token bill point to completely different problems, and that distinction only becomes visible once attribution runs at the request level. A ballooning input-token cost usually traces back to prompt bloat, retrieval pulling in too much context, or oversized context windows. A ballooning output-token cost usually means verbose generations, long reasoning traces, or a response format that's more expensive than it needs to be.

Pricing makes this concrete. As of June 7, 2026, GPT-5.4 is listed at $2.50 per 1 million input tokens and $15.00 per 1 million output tokens; Claude Sonnet 4 is listed at $3 per million input tokens and $15 per million output tokens. At those rates, the gap between a well-attributed system and a poorly-attributed one isn't academic. It's the difference between a team spotting a cost spike the day it happens and catching it a month later, buried in a bill nobody can fully explain. SOURCE PAGES: what the pages behind the outline's links say.