Limits and spend

Your own provider keys have no money ceiling. Managed Keys spends a prepaid balance, so it can run out. Two response headers report what you have left. GET /v1/limits reports the whole picture in one call.

Your own keys have no money ceiling

We set no request allowance and no monthly cap. You hold no balance to draw down. See pricing and billing. One ceiling applies. Your organization runs a fixed number of flex races at a time. Past that number we run the request on the standard tier. You lose the discount, not the answer. The report calls that number own_keys.flex_race_slots.

What Managed Keys can run out of

Ceiling	What it counts	At the ceiling
Prepaid balance	Cash first, then promo credits.	`insufficient_balance`, status `402`.
Daily spend ceiling	Spend settled today, plus today’s requests in flight. The window is a UTC day.	`spend_velocity_exceeded`, status `429`.
Managed concurrency	Your managed requests in flight.	`rate_limit_exceeded`, status `429`, with `Retry-After`.
Shared pool rate	Requests a minute on a pool every managed organization shares. Today that is Workers AI and Foundry.	`rate_limit_exceeded`, status `429`.

A risk review can pause managed requests on top of those four. It returns account_under_review. Your own key routes keep working. Four more limits cover every organization. Three count requests a minute from one organization, from one key, and from one IP address. The fourth counts failed authentication attempts from one IP address. We also refuse a body over 50,000,000 bytes as request_too_large. The report names each per-minute limit with its window and its scope. It leaves the number out, because Cloudflare counts each one in every location it runs in and one number wouldn’t be a budget you could plan against. Back off for the seconds in Retry-After instead.

Two response headers report your spend

An own-keys response carries them once its routes resolve, and a managed response carries them from the balance hold on. Three responses have neither header: one we turned away earlier, the model catalog, and a managed request whose balance we couldn’t read. We leave the headers off rather than guess.

Header	What it says
`x-flexinference-spend-remaining`	The word `unlimited` when no money ceiling applies. Otherwise a signed micro-USD integer. It is the smaller of your balance and what the daily ceiling still allows.
`x-flexinference-spend-as-of`	When we read that number, in epoch milliseconds. It only comes with a number, since `unlimited` needs no freshness mark.

We read both as we admitted this request. The number covers what you had left before this request settled its own cost. A negative number means we turn away every managed request. Adding money repairs a negative balance. A negative daily remainder recovers at the next UTC midnight or with a raised ceiling, never with a top-up. Read these headers on traffic you already send. Polling the endpoint before every request costs a round trip and tells you no more than the header did.

The limits endpoint

GET /v1/limits takes your FlexInference key. It reports the ceilings your organization runs under. It reads the records that admit your requests, so it never claims room we’d turn away. We never cache the answer.

curl https://api.flexinference.com/v1/limits \
  -H "Authorization: Bearer $FLEXINFERENCE_API_KEY"

{
  "object": "limits",
  "as_of": 1769558400123,
  "own_keys": {
    "unlimited": true,
    "flex_race_slots": {
      "limit": 40,
      "scope": "organization",
      "on_exceed": "degrade_to_standard"
    }
  },
  "managed": {
    "providers": ["anthropic", "openai"],
    "serving": "ok",
    "paused_reason": null,
    "binding": "daily_spend",
    "spend_remaining_micro_usd": 41200000,
    "currency": "USD",
    "balance": {
      "remaining_micro_usd": 94880000,
      "cash_micro_usd": 84880000,
      "credit_micro_usd": 10000000,
      "reserved_micro_usd": 120000
    },
    "daily_spend": {
      "limit_micro_usd": 250000000,
      "used_micro_usd": 208800000,
      "remaining_micro_usd": 41200000,
      "window": "utc_day",
      "resets_at": 1769644800
    },
    "concurrency": {
      "limit": 10,
      "scope": "organization",
      "on_exceed": "refuse"
    },
    "ramp_week": 1,
    "ramp_defaults": {
      "concurrency": 10,
      "daily_spend_micro_usd": 250000000
    },
    "override_in_force": {
      "concurrency": false,
      "daily_spend": false
    },
    "rates": []
  },
  "abuse_limits": {
    "counted_per_cloudflare_location": true,
    "request_body_bytes": 50000000,
    "rates": [
      {
        "name": "organization_requests",
        "scope": "organization",
        "window_seconds": 60,
        "limit": null,
        "on_exceed": "refuse"
      },
      {
        "name": "api_key_requests",
        "scope": "api_key",
        "window_seconds": 60,
        "limit": null,
        "on_exceed": "refuse"
      },
      {
        "name": "client_ip_requests",
        "scope": "client_ip",
        "window_seconds": 60,
        "limit": null,
        "on_exceed": "refuse"
      },
      {
        "name": "failed_authentications",
        "scope": "client_ip",
        "window_seconds": 60,
        "limit": null,
        "on_exceed": "refuse"
      }
    ]
  }
}

Every money field is a micro-USD integer. One USD is 1,000,000 of them.

Field	What it says
`as_of`	Epoch milliseconds. The balance’s own clock when we read a balance, and ours when we didn’t.
`own_keys.unlimited`	Always `true`.
`own_keys.flex_race_slots`	How many flex races run at a time. Passing the number costs the discount, not the answer.
`managed`	`null` when no provider serves on managed keys.
`managed.serving`	`ok`, or `paused` in each of the three states that turn every managed request away.
`managed.paused_reason`	Which state. One of `account_under_review`, `spend_velocity_exceeded`, or `insufficient_balance`. It is `null` while serving reads `ok`.
`managed.binding`	Which ceiling bites first. One of `balance`, `daily_spend`, `paused`, or `exempt`.
`managed.spend_remaining_micro_usd`	The number the `x-flexinference-spend-remaining` header carries.
`managed.balance`	`remaining_micro_usd` is cash plus credit. That is the quantity we compare to zero. `reserved_micro_usd` is money your in-flight requests hold, and we don’t subtract it.
`managed.daily_spend`	The ceiling, what today has used, and what is left. `resets_at` is the next UTC midnight in epoch seconds.
`managed.concurrency`	How many managed requests your organization runs at a time.
`managed.ramp_week`	Which week of the account-age schedule you sit in. Week 0 covers an account that has never topped up.
`managed.ramp_defaults`	What that week alone gives you. One concurrency number and one daily ceiling.
`managed.override_in_force`	One flag per ramped ceiling. `true` means an admin set that number, so the weekly schedule won’t move it.
`managed.rates`	The per-minute limits on the shared pools this organization serves on.
`abuse_limits`	The limits every organization shares, plus the body cap in bytes.

The last three fields say why your concurrency number and your daily ceiling read as they do. An exempt organization has no ceiling to explain, so all three read null. A paused balance reports the pause in place of a number. No positive figure can then read as permission to send. These numbers hold at as_of and promise nothing about your next request. Another request moves them, and so does a settlement, a top-up, or a refund. A missing or wrong key returns 401 with invalid_api_key. When we can’t read one of these records, the endpoint returns 503 with limits_unavailable. It refuses rather than hand you a cached figure, which could claim room your next request wouldn’t get. Requests keep working either way.

Cost inside a stream

A response you didn’t stream reports its cost twice, in the x-flexinference-cost header and the usage.cost block. A streamed response can’t use the header, because we send headers before the answer exists and we don’t know the cost then. Send include_cost: true to move the cost inside the stream.

{
  "model": "gpt-5.5",
  "start_within": "00h-00m-30s",
  "stream": true,
  "include_cost": true,
  "input": "Summarize this contract."
}

The cost then goes in the usage frame the endpoint already sends. A usage.routing block sits beside it and names the route that ran the request.

"usage": {
  "input_tokens": 412,
  "output_tokens": 128,
  "cost": { "total_micro_usd": 1840, "currency": "USD" },
  "routing": {
    "provider": "openai",
    "requested_provider": "openai",
    "tier": "flex",
    "reason": "flex_won",
    "fallback_attempts": 0,
    "mode": "byok"
  }
}

The switch stays off by default. A stream you didn’t ask this of matches what the provider sent, byte for byte. /v1/chat/completions makes the usage frame itself opt-in at OpenAI. Send "stream_options": {"include_usage": true} as well. Without it the cost has no frame to go in. A managed request reports what the provider charged us. An own-keys request reports the provider’s list price at the tier that ran it. A request we can’t price reports no cost at all. Read a missing block as nothing to report, not as zero. Two routing headers come on every response either way. They are x-flexinference-served-provider and x-flexinference-routing-reason. A streaming caller who skips include_cost still sees which route ran the request and why. See reading the outcome. include_cost never reaches the provider. We remove it from the body before we forward the request.

Get started

Concepts

Using the API

Agent Keys + Integrations

FAQ

Your own keys have no money ceiling

What Managed Keys can run out of

Two response headers report your spend

The limits endpoint

Cost inside a stream

​Your own keys have no money ceiling

​What Managed Keys can run out of

​Two response headers report your spend

​The limits endpoint

​Cost inside a stream

Your own keys have no money ceiling

What Managed Keys can run out of

Two response headers report your spend

The limits endpoint

Cost inside a stream