How do I limit ElevenLabs API spend per key?

Configuring credit quotas and key restrictions

Every single request you send to the ElevenLabs API requires an API key, which the platform uses to authenticate the caller and count usage against your quota. You pass this key on every call using the xi-api-key HTTP header. If you leave your keys unrestricted, anyone who grabs one can spend your workspace's entire monthly credit pool on whatever voice models they want.

To lock that down, ElevenLabs provides 3 controls on every key you generate:

1. Credit quota: You define custom credit limits to control usage on that individual key. Once the key reaches that limit, it won't process further paid generation requests.
2. Scope restriction: You set access restrictions by limiting which API endpoints the key can call. A background worker that only needs speech-to-text doesn't need permissions to clone voices or query workspace data.
3. IP allowlisting: You restrict the key to specific IP addresses or CIDR blocks. Requests from non-allowlisted IPs are rejected with a 403 error immediately.

If you are setting up local developer environments or wiring up automated coding agents, you can generate keys during initialization. Running npx -y @elevenlabs/cli@latest onboard init walks you through signing in or creating an account, generates an API key, and pulls the SDK into your project.

npx -y @elevenlabs/cli@latest onboard init

Just remember that developer keys should never end up in front-end code. If you suspect an unrestricted key slipped into a public repo, check What should I do in the first hour after an API key leaks? to contain the exposure quickly.

Comparing personal and service account keys

How you manage spend depends heavily on whether you generate keys under your own profile or through a dedicated workspace service account.

Isolating credentials with Service Accounts

For production workloads, relying on personal keys creates an operational bottleneck. ElevenLabs Service Accounts and their respective API keys allow access to workspace resources without relying on an individual's access to ElevenLabs. A service account acts as a workspace member, meaning background workers and server jobs don't break when team members leave.

There is a catch for solo developers: Service Accounts are currently only available for multi-seat customers, and only Workspace admins can use this feature. To upgrade, get in touch with the ElevenLabs sales team.

When originally created, a service account has zero access to any resources. It can't generate audio, view projects, or read data until an admin grants permission.

You grant resource access in one of two ways:

• Directly sharing resources with the service account.
• Adding the service account to a group.

ElevenLabs explicitly recommends adding them to a group so future users added to the same group inherit the identical set of permissions. Once the group permissions are in place, you create API keys directly inside that service account to authenticate your requests. If you run multiple pipelines, split them across separate service accounts - a workspace can have at most 20 service accounts - and assign each a distinct credit quota.

Why bother with service account keys over regular keys? Programmatic management. Only service account keys can be disabled or capped through the API; personal keys cannot.

Protecting keys in client applications

Do not share your API key with others or expose it in any client-side code, including web browsers, desktop apps, and mobile clients. Because all standard API requests require passing the credential inside the xi-api-key header, putting a raw key inside client bundles allows any user to inspect network traffic, grab the string, and drain your quota.

For certain endpoints, you can use single use tokens to authenticate your requests. These tokens are valid for a limited time and can be used to connect to the API without exposing your API key, for example from the client side.

If you run client-driven apps that cannot use single use tokens, proxy your audio generation through your own backend. Your backend server holds the restricted ElevenLabs key, validates incoming user sessions, applies your own rate limits, and forwards the generation call.

Querying ElevenLabs usage metrics via API

Setting caps in the UI helps, but you also need to monitor consumption trends so your jobs don't silently fail when a key hits its ceiling.

The legacy character usage metrics endpoint is deprecated in favor of /v1/workspace/analytics/query/usage-by-product-over-time. The replacement endpoint exposes the bucket size as interval_seconds (an integer in seconds) rather than the older aggregation_interval text format.

If you are maintaining code built on the legacy usage endpoint, it returns usage metrics for the current user or the entire workspace they belong to. The response provides a time axis based on a specified aggregation interval - which defaults to a day - and gives you usage values for each interval along that axis.

When querying that endpoint, several query parameters dictate the response shape:

• start_unix: Required integer. UTC Unix timestamp for the start of the window, in milliseconds. To include the first day, set the timestamp to 00:00:00 of that day.
• end_unix: Required integer. UTC Unix timestamp for the end of the window, in milliseconds. To include the last day, set the timestamp to 23:59:59 of that day.
• include_workspace_metrics: Optional boolean, defaults to false.
• breakdown_type: Defines how metrics are sliced. Setting it to voice returns the usage of each voice for each interval along the time axis. It cannot be set to user if include_workspace_metrics is false.
• aggregation_interval: Accepts hour, day, week, month, or cumulative.
• aggregation_bucket_size: Integer in seconds. Overrides aggregation_interval.
• metric: Optional enum defining which metric to aggregate.

A successful query returns two fields: time (a list of integers representing timestamps for each day) and usage (a map from strings to lists of doubles representing values across the time axis). Sending an invalid query payload returns a 422 Unprocessable Entity Error. For a deeper breakdown of how credits map to dollar costs across plans, see our guide on How does ElevenLabs pricing work for the API?.

Spend alerts and manual brakes with Costbrake

Watching charts manually won't help if an unmetered script enters a tight retry loop at 2 AM. Costbrake watches what you spend across 23 cloud, AI and SaaS providers, including ElevenLabs, AWS, OpenAI, and Anthropic. It alerts you to anomalous burn and includes opt-in killswitches called brakes.

Checks run hourly on the Free plan, every 5 minutes on Pro and Team, and ramp up to every 2 minutes during an active spike. A spike alert fires when an hour costs more than 3x the usual hour based on your 7-day baseline, provided it is at least $5 above normal. You also get budget alerts at 50%, 80%, and 100% thresholds, new-charge alerts when a service crosses $1 for the first time in a month, and forecast alerts when recent 72-hour pacing will overrun your month-end budget.

For ElevenLabs, Costbrake reads fiat usage figures directly - spreading your plan price over the credits you use - and offers two specific brakes:

• Disable service account API key: Every request made with that key fails immediately until re-enabled. Other keys keep working.
• Freeze credit usage of an API key: Sets the key's monthly credit limit to what it has already used this month, causing further paid requests with it to fail.

Brakes only run when an admin clicks and confirms them in the dashboard; Costbrake never stops traffic on its own. Each brake records the prior state, has an undo function, and never deletes underlying resources.

Connecting takes a service account key with two specific permissions: user_read and workspace_analytics_full_read. You can have an AI assistant handle setup via agent setup or connect through the web dashboard. Costbrake offers a 14-day Pro trial with no card required; paid plans start at $12 a month flat, never taking a percentage of your spend. Review full details on Costbrake pricing.