$16.40 for 10,000 AI Calls: A Backend Proxy Receipt

01 / The $16.40 receipt is a worksheet, not a quote

Putting AI calls behind your backend gives you somewhere to enforce spending rules. It does not make inference free. Start with an itemized bill, then build the controls that keep actual spending close to it.

Here is a hypothetical month with 10,000 completed requests. Every price below is an illustrative planning assumption, not a CheapRelay rate, hosting quote, or measured benchmark. Replace these assumptions with your selected model’s current prices and your infrastructure charges before budgeting.

• ■ Uncached input: 8 million tokens × $0.50 per million = $4.00.
• ■ Output: 2 million tokens × $2.00 per million = $4.00.
• ■ Cache reads: 4 million tokens × $0.10 per million = $0.40.
• ■ Cache writes: 1 million tokens × $0.50 per million = $0.50.
• ■ Backend hosting allocation: $5.00.
• ■ Logs and monitoring allocation: $2.00.
• ■ Network transfer allocation: $0.50.
• ■ Total: $16.40, or $0.00164 per completed request.

The token categories here are separate, non-overlapping billing quantities. Do not count cached input again as uncached input. Match your worksheet to the actual billing categories; cache writes may have different treatment across models. This example excludes taxes, engineering time, tool charges, and failed or repeated attempts.

02 / Keep the paid credential behind one narrow endpoint

Use this request path: authenticated client, your backend, upstream relay, your backend, client. Keep the relay credential in a server-side secret store. Never ship it in browser JavaScript, a mobile bundle, or a public configuration variable. OpenAI’s key-safety guidance explicitly recommends routing requests through your backend rather than exposing credentials client-side. ([help.openai.com](https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safet?utm_source=openai))

CheapRelay fits at the upstream step: one key accesses multiple model families, with OpenAI-compatible routes under /v1 and Gemini-native routes under /v1beta. Its pay-as-you-go billing covers real tokens, including cache reads and writes, without a monthly fee or subscription. Your own hosting and operations remain separate receipt lines.

Configure the upstream destination on the server. Do not accept a caller-supplied base URL or forward arbitrary paths. Restrict outbound destinations and permitted operations; otherwise, a convenient relay endpoint can become a server-side request forgery surface. ([cheatsheetseries.owasp.org](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html?utm_source=openai))

03 / Turn a $0.00164 average into enforceable limits

Authenticate each request and authorize the account for the requested operation. Keep credentials out of URLs, and allow only the HTTP methods your endpoint requires. These are baseline REST security controls, not optional extras for a cheap API. ([cheatsheetseries.owasp.org](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html?utm_source=openai))

For this example application, choose explicit starting limits: a 32 KB request body, 1,000 maximum output tokens, two concurrent generations per account, and ten generation requests per minute. These are proposed application settings, not provider limits. Adjust them to your workload. OWASP specifically identifies missing resource limits as an API risk. ([api-security.owasp.org](https://api-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption/?utm_source=openai))

Add a $1 daily account budget and a $20 daily application budget. Before dispatch, atomically reserve estimated input cost plus maximum permitted output cost. Include possible cache charges. Reject requests when available budget cannot cover the reservation, then reconcile against reported usage. Keep unresolved reservations conservative rather than assuming missing usage means zero cost.

04 / Give retries and logs their own receipt lines

Budget upstream attempts, not just successful answers. At the example’s $8.90 token subtotal, 1,000 additional attempts with the same average billed usage add $0.89. Actual retry cost depends on what the upstream processes and bills; do not automatically replay an interrupted stream.

Assign a request ID and record account, selected model, attempt number, usage categories, estimated charge, final charge, and status. Redact authorization headers and avoid logging prompts by default. API keys and security tokens should not enter request URLs or ordinary access logs. ([cheatsheetseries.owasp.org](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html?utm_source=openai))

05 / Test the $20 stop before accepting public traffic

Test anonymous requests, oversized bodies, unsupported models, simultaneous budget reservations, timeouts, and exhausted balances. Verify that rejected requests never reach the upstream. Keep a server-side kill switch and a credential-rotation procedure ready.

Sign up for CheapRelay when you are ready to connect the upstream, then replace every illustrative token rate in this receipt with the applicable price. The goal is not merely a hidden key: it is a bill you can explain and spending your backend can stop.