$13.66 for 10,000 AI Requests: A Backend Receipt

01 / The $13.66 receipt starts with explicit assumptions

Putting an AI API behind your backend protects the upstream key, but it also makes your server responsible for abuse, retries, and surprise bills. Start with a receipt, not a promise that a proxy automatically saves money.

Here is an illustrative monthly workload: 10,000 intended requests, averaging 800 input tokens and 200 output tokens each. Assume input costs $0.50 per million tokens and output costs $2.00 per million. These are arithmetic examples, not quoted CheapRelay prices. Check the current rate for your selected model before budgeting.

• ■ Input: 10,000 × 800 = 8 million tokens; cost: $4.00.
• ■ Output: 10,000 × 200 = 2 million tokens; cost: $4.00.
• ■ Extra attempts: assume 200 billable retries with the same average token usage; cost: $0.16.
• ■ Backend compute: assume a $5.00 monthly allocation.
• ■ Network charges: assume $0.50 for this workload.
• ■ Total: $13.66, or $0.001366 per intended request.

The hosting and network amounts are planning allowances, not provider quotes. This receipt excludes taxes, storage, monitoring, development time, and cache charges. It assumes text-only traffic. Larger outputs, tool loops, or a different model rate change the result immediately.

02 / Keep the upstream key behind one narrow endpoint

Your browser should call your own authenticated endpoint. That endpoint validates the request, builds the upstream payload, and attaches the relay key server-side. Never ship that key in frontend JavaScript, mobile application bundles, URLs, or error messages.

CheapRelay provides a pay-as-you-go relay with an API base of https://api.cheapapirelay.com and OpenAI-compatible routes under /v1. Store the key in a server-side secret manager or protected environment variable. Use separate credentials for development and production where supported, and rotate any exposed credential.

Do not build an unrestricted forwarding service. Fix the upstream host and allowed routes in server configuration. Otherwise, a caller-controlled URL can turn your proxy into a server-side request forgery tool. Allowlist models and parameters; do not let a browser choose an expensive model simply by changing a JSON field.

03 / Protect the $8.00 token subtotal before adding retries

Authenticate every request and authorize access to the relevant account or project. Apply per-user request limits, concurrency limits, and spending allowances. A global limit alone lets one abusive account consume everybody else's budget. CORS is not authentication.

Validate input size and set an explicit output-token limit supported by the selected endpoint. Count the full upstream context, including system instructions and conversation history. Our receipt assumes 800 input tokens; repeatedly resending a growing chat can invalidate that average.

For a $20 monthly application budget, an alert at $15 leaves $5 of headroom. Reserve estimated maximum request cost before dispatch, then reconcile against reported usage. Include in-flight requests when deciding whether to admit another one. An alert is not a hard cap, and delayed usage reporting makes exact enforcement harder.

04 / The $0.16 retry line needs its own limit

Retry transient failures only when appropriate, with backoff, jitter, and a small attempt limit. Do not retry invalid credentials or malformed requests. A timeout does not prove the upstream did no billable work.

The receipt deliberately budgets 200 extra fully billable attempts. Real failed attempts may consume fewer tokens, more tokens, or none. Record attempts separately from user requests so retries cannot hide inside a misleading success count.

Deduplicate repeated submissions within your application where practical. Cancel upstream work when clients disconnect if supported, but do not assume cancellation erases charges. For tool-enabled workflows, separately authorize side effects; retrying a request must not accidentally repeat a purchase or deletion.

05 / Reconcile billed tokens without collecting every prompt

Log request identifiers, account identifiers, model selection, latency, status, token usage, and estimated cost. Redact authorization headers and avoid retaining raw prompts by default. Return sanitized errors rather than upstream credentials or internal traces.

CheapRelay has no monthly fee or subscription and bills per real token, including cache reads and writes. Track those categories separately when applicable; caching is not automatically free. Sign up for CheapRelay when you are ready to test a small, capped workload, then replace every assumed rate in this receipt with your actual billing data.