Claude Code and Codex for a Dev Team: One Key per Developer

To roll out Claude Code and Codex to a dev team on Router One, create one API key per developer under one account, give each key a spend cap (maxSpend), and have each developer run the one-click setup with their own key. Every request is then recorded against the key that sent it, so Dashboard → Usage shows who spent what. The cap is cumulative (it does not reset each month) and limits only what a key charges to the wallet: requests covered by a Pro, Max or Ultra plan draw the account's shared plan quota, so to stop someone completely, delete their key.

Per-key spend limits are common among LLM gateways, and some reset on a daily, weekly or monthly schedule. This post is about how the pattern works on Router One specifically: what each setting does, where plans change the picture, and what we do not offer.

As of 2026-10-23

• The unit of control is the API key. An account can hold many keys; each has a name, an optional expiry date and an optional spend cap, set in Dashboard → API Keys and editable later.
• A key's spend cap (maxSpend) limits what that key can charge to your wallet: once its cumulative wallet charges reach the cap, its wallet-billed requests return HTTP 402. Requests covered by your plan's quota draw from the account's shared plan quota and do not count toward any key's cap.
• The cap counts everything the key has charged to the wallet since the key was created. Nothing resets it on a schedule.
• Plans are per account: Pro $20.19, Max $47.99 and Ultra $149 per 30-day cycle, and every key on the account draws the same quotas. There are no per-seat plans.
• Dashboard → Usage ranks keys by spend, tokens and requests; Dashboard → Logs filters by key and exports to CSV.
• Developers get a key, not a dashboard login: there are no member accounts, roles or SSO.
• A key that has expired but was not deleted still counts toward the account's active-key limit.

Who this fits: a small development team that wants Claude Code and Codex CLI on one account and one bill, a cap per person, and a weekly view of who spent what; that can pay by card, Alipay or stablecoin; and whose finance team can work with the invoice the hosted checkout emails automatically.

Look elsewhere if: each developer must sign in with their own account, SSO or role; you need caps that reset every month without anyone touching them; or you need Chinese VAT invoices (fapiao), a bank transfer, or a signed contract before the first top-up. Buying LLM API access for a company lists what Router One offers buyers and what it does not.

Why one key per developer

• Attribution. Dashboard → Usage and Dashboard → Logs attribute every request to the key that sent it. A shared key gives you one line for the whole team; a key per developer gives you a line per person. Logs also show the model, and Claude Code sends Claude models while Codex sends GPT-family, DeepSeek or Grok models, so one key per developer already lets you tell the two tools apart.
• Containment. A coding agent sends a request for every model turn, including turns that only hand a tool result back, so a long unattended task can bill many requests without anyone typing. A cap on each developer's key keeps one runaway session's wallet charges from eating everyone's balance.
• Offboarding. When someone leaves, you delete one key. Nobody else reconfigures anything.

Give CI jobs and shared bots keys of their own instead of borrowing a person's key, so their spend shows up as its own line.

Contractors can have keys too. Under the Terms, you may issue keys to your own employees and contractors working on your behalf, as long as the keys stay under your control and are not published or handed to third parties for their own use; the account holder is responsible for all usage on the account, whoever sends the requests. Give a contractor's key an expiry date that matches the contract, and delete it when the work ends.

Company accounts with multiple members (one company payer, each member on their own keys) are coming soon, with no launch date yet; today, use one account with one key per person.

Step 1: Create the keys

In Dashboard → API Keys, create one key per developer:

• Key Name: something you will recognize in Usage and Logs, such as dev-alice or contractor-bo. If you want Claude Code and Codex on separate caps, create dev-alice-claude and dev-alice-codex instead.
• Expiration Date (optional): useful for contractors and trials. An expired key stops authenticating (HTTP 401).
• Spending Limit (USD) (optional): the key's maxSpend. Leave it off and the key is limited only by the wallet.

Name, expiry and spending limit can all be changed later with Edit. An account can hold many keys, but keys that have expired without being deleted still count toward the account's active-key limit, so delete keys you no longer need rather than letting them lapse. Send each developer their key over a private channel, never in a group chat or a ticket.

Step 2: Configure Claude Code and Codex on each machine

Each developer runs the one-click scripts with their own key. On macOS or Linux:

curl -fsSL https://router.one/install/claude-code.sh | bash -s -- sk-your-api-key
curl -fsSL https://router.one/install/codex.sh | bash -s -- sk-your-api-key

On Windows (PowerShell):

$env:ROUTER_ONE_API_KEY = "sk-your-api-key"; irm https://router.one/install/claude-code.ps1 | iex
$env:ROUTER_ONE_API_KEY = "sk-your-api-key"; irm https://router.one/install/codex.ps1 | iex

The Claude Code script installs Claude Code if it is missing, writes ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN into the env block of ~/.claude/settings.json, and checks the key with a one-token request. The Codex script installs Codex CLI if it is missing, writes ~/.codex/config.toml, saves ROUTER_ONE_API_KEY in the shell profile, and checks the key.

Claude Code by hand. Two variables: the host root without /v1 (Claude Code appends its own path) and the developer's key.

export ANTHROPIC_BASE_URL=https://api.router.one
export ANTHROPIC_AUTH_TOKEN=sk-your-api-key

If both a shell export and the env block of ~/.claude/settings.json set the same variable, the settings file wins. Keep the key in the user-level ~/.claude/settings.json on each developer's machine, never in a project's .claude/settings.json that is committed to the repository.

Codex by hand. This is the ~/.codex/config.toml the one-click script writes:

model = "gpt-5.6-sol"
model_provider = "router"
model_reasoning_effort = "high"
model_verbosity = "high"
web_search = "live"

[model_providers.router]
base_url = "https://api.router.one/v1"
env_key = "ROUTER_ONE_API_KEY"
env_key_instructions = "Create an API key at https://router.one/dashboard/api-keys and set the ROUTER_ONE_API_KEY environment variable."
name = "Router One"
wire_api = "responses"

The env_key line holds the name of an environment variable, not the key itself, so the same config.toml can be shared across the team while each developer exports their own key as ROUTER_ONE_API_KEY.

Which model each tool asks for, and which of those models a plan tier covers, change with tool releases and with the catalog. Claude Code in China and Codex CLI in China keep the current model settings, and the CLI setup guide covers the manual steps on every OS. The scripts configure the two CLIs. Per the vendors' docs (checked 2026-10-19), Claude Code's desktop app reads gateway settings from its own configuration rather than from these variables, its web sessions are not part of a gateway setup, and Codex cloud requires a ChatGPT sign-in.

Step 3: Decide between a plan and the wallet

Requests bill per token from a prepaid wallet at each model's posted rate on /models, or from a plan's quota for the models a Pro, Max or Ultra tier lists on pricing. For a team, the difference that matters is how the plan interacts with the keys:

• A plan belongs to the account, not to a developer. Every key on the account draws from the same tier quotas, so one developer's agent can use up the plan quota for everyone. As of 2026-10-15, when a tier has 20% or less of its monthly requests left, Router One sends an email to the account address and an in-app notification, at most once per tier per billing period.
• The key cap does not limit plan usage. A key's spend cap (maxSpend) limits what that key can charge to your wallet: once its cumulative wallet charges reach the cap, its wallet-billed requests return HTTP 402. Requests covered by your plan's quota draw from the account's shared plan quota and do not count toward any key's cap. Calls beyond a tier's quota, and models no tier lists, bill to the wallet at posted rates, and those charges do count toward the key's cap.
• Wallet-only billing keeps the caps in full control. Without a plan, every request a key sends is a wallet charge, so each developer's cap bounds what their key can spend.
• The wallet never tops itself up. When it runs empty, wallet-billed requests on every key return HTTP 402. Poll GET /v1/balance from a server to warn before that happens (balance monitoring).

Top up with a card or Alipay through one hosted checkout, or with USDT/USDC on six chains (Tron, BSC, Ethereum, Polygon, Base, Arbitrum). No US credit card required. Every payment through the hosted checkout is invoiced automatically to the checkout email; these are not Chinese VAT invoices (fapiao), and stablecoin top-ups are not invoiced. Purchased credits are non-refundable once added to your balance, except for billing errors on our side or where required by law, so start with a small top-up and scale once the setup works for the team.

Step 4: Review usage weekly

A weekly look takes a few minutes:

1. Dashboard → Usage, by API key. Rank the keys by spend, tokens or requests for the week, and open any key's own logs from there. On a plan, rank by requests as well as spend: plan-covered requests draw the shared quota.
2. Dashboard → API Keys. Each capped key shows its spend against its limit. The dashboard also sends an in-app notification when a key reaches 80% of its cap and when it reaches the cap (in-app only, not by email or webhook).
3. Dashboard → Logs, filtered by API key and date range. Each request shows its model, request ID, tokens, cost, latency and status. Export the current filters to CSV (up to 100,000 rows per export) and keep it with the wallet ledger's CSV for your records.

Logs only list requests that reached a model. A request refused before that, such as an HTTP 401 from a deleted or expired key, a 402 at a cap or from an empty wallet, or a 429 from the platform's rate limits, has no row. When a developer says their tool stopped working, ask for the error body: a key at its cap gets HTTP 402 with api key spend cap reached: raise or clear this key's maxSpend …, and the message notes that topping up the wallet does not lift it. Raise that key's cap with Edit if the work justifies it.

Rate limits are platform defaults on each key and on the account, not something you configure. If the team's agents keep getting 429s, back off and retry, then email support@router.one with your account ID, the key and your expected peak requests and tokens per minute to have the limits raised.

Dashboard → Logs shows request metadata, as listed above. For what Router One retains, see the data retention policy.

Offboarding, leaks and rotation

• Someone leaves, or a contract ends: delete their key in Dashboard → API Keys. Anything still using it gets HTTP 401. Lowering the cap is not enough on a plan account, because plan-covered requests do not count toward any key's cap.
• Do not wait for an expiry date: an expired key stops authenticating, but it keeps counting toward the account's active-key limit until you delete it.
• A key may have leaked: delete it first, then create a replacement for its owner. Filter Logs by the old key to see which models it called and when.
• Routine rotation: create the new key, have the developer rerun the one-click script with it, check that their requests now appear under the new key in Logs, then delete the old one.

How large should each cap be?

A cap is a running total, not a monthly allowance, so set it to what you are willing to let a key spend before you next look. If you want a per-month allowance, apply it by hand at each review: set the cap to what the key has spent so far plus next month's allowance.

For a starting point, there are a few public reference figures (none of them Router One data):

• Uber used up its AI budget for all of 2026 within about four months, The Information reported in April 2026. Bloomberg then reported that Uber limits every employee to $1,500 of token spending per month for each AI coding tool, such as Claude Code or Cursor (Bloomberg, 2026-06-02).
• In a V2EX thread posted on 2026-08-31 asking developers what they spend on AI, most replies put individual monthly spend between about ¥100 and ¥1,400, or roughly $20 to $200 for those answering in dollars; several said they pay out of pocket.

What a developer actually spends depends on the model and on how much context each turn carries. Claude Code token costs explains where the tokens go, and the cost calculator estimates a workload at posted rates. Start with a cap that covers about two weeks of expected use, review weekly, and raise it where the work justifies it.

What Router One does not offer

As of 2026-10-23:

• Member accounts, roles or SSO. Developers receive a key, not a login; whoever signs in to the account sees all keys, usage and logs.
• Caps that reset on a schedule. maxSpend is cumulative per key; any per-month allowance is applied by hand.
• Per-key model restrictions. A key can call any model in the catalog that its tool can reach.
• A key-management or usage API. Keys are created in the dashboard, usage is read in the dashboard or from CSV exports, and GET /v1/balance returns the wallet balance only.
• Customer-set rate limits. They are platform defaults, raised on request by email.

FAQ

Can a whole development team share one Router One account? Yes. Use one account with one API key per developer, so each person gets their own spend cap and their own line in Usage and Logs. Under the Terms, keys may go to your employees and contractors working on your behalf, as long as they stay under your control; the account holder is responsible for all usage on the account.

Does a key's spend cap reset every month? No. maxSpend counts everything the key has charged to the wallet since the key was created, and nothing resets it on a schedule. To give someone a monthly allowance, raise their cap at each review to what they have spent so far plus the next month's amount.

If we buy a plan, does each developer's cap limit their plan usage? No. Plan-covered requests draw the account's shared plan quota and do not count toward any key's cap; the cap only limits what a key charges to the wallet. One developer's agent can therefore use up the plan quota for the whole team. To stop someone completely, delete their key.

How do I see what each developer spent this week? Open Dashboard → Usage and rank the API keys by spend, tokens or requests for the week; each key links to its own logs. Dashboard → Logs filters by key and date range and exports the current filters to CSV, and Dashboard → API Keys shows each capped key's spend against its limit.

What should we do when someone leaves? Delete their key in Dashboard → API Keys; anything still using it gets HTTP 401. Do not rely on an expiry date or a lower cap: an expired key still counts toward the account's active-key limit until it is deleted, and a cap does not stop plan-covered requests.

Do developers need their own Claude or ChatGPT subscription? Not for Claude Code CLI or Codex CLI on a Router One key: the requests go to Router One and bill to your account. The vendors' own surfaces that do not use a gateway, such as Codex cloud, still need the vendor's sign-in.

Can we pay as a company and get an invoice? Top up with a card or Alipay through the hosted checkout, or with USDT/USDC on six chains. Every hosted-checkout payment is invoiced automatically to the checkout email; these are not Chinese VAT invoices (fapiao), and stablecoin top-ups are not invoiced. For payment, invoices and contracts, and what Router One does not offer companies, see Buying LLM API access for a company.

Next steps

• Buying for a company: payment, invoices, limits and what we don't offer
• Setup per tool: Claude Code in China, Codex CLI in China, CLI setup guide
• Every coding tool on one gateway: AI coding tools
• Reading spend per key: track LLM API costs per key and LLM cost tracking
• Watching the wallet from a server: balance monitoring
• Plans and rates: pricing and models

Create one key per developer at router.one, give each a cap, and look at Usage by key after the first week.