> Markdown mirror of https://router.one/blog/resell-llm-api-spend-capped-keys for AI assistants and crawlers. Router One is an OpenAI-compatible LLM API gateway.
> Published: 2026-06-10 · Last updated: 2026-09-05 · Author: Router One Team

# Reselling LLM API Access Safely with Spend-Capped Keys

_Resell LLM API access safely on a managed upstream: one key per customer, per-key spend caps and rate limits, and per-request usage data for billing._

There is a small but real business in packaging LLM access for people who don't want to manage it themselves: agencies bundling AI features into client projects, consultants running workloads for several customers, builders selling a niche tool with model calls inside. Most "how to resell AI APIs" content either oversells what's possible or quietly assumes you'll run a grey-market relay. This post does neither.

Here is the honest version: what you can build today on key-level controls over a managed upstream, how the economics work, and — just as important — what this pattern does *not* give you.

## The pattern: one customer, one key

Router One gives one account a managed upstream to [30+ supported models](https://router.one/models) through a single wallet, and lets that account create many API keys. Each key carries three independent controls:

- **maxSpend** — a hard ceiling on what the key may spend from your wallet
- **rateLimit** — how fast it may send requests
- **tokenLimitTpm** — a per-minute token ceiling

That is enough to run a clean reseller loop:

1. Create one key per customer, with a spend cap matching what they prepaid you.
2. Hand over the key (or embed it server-side in the tool you run for them).
3. Watch per-key usage — requests, tokens, spend — in the dashboard, in real time.
4. When a customer's cap is reached, their key stops. Your wallet, and your other customers, are unaffected.
5. Re-bill, raise the cap, repeat.

Your cost basis is the pay-as-you-go token line at each model's posted rate — the same per-1M-token prices published on the models page — plus checkout-visible FX/channel fees when you top up. Whatever you charge customers on top, for curation, integration, support, or uptime ownership, is your margin and lives in **your** invoice, not inside an opaque per-token markup. The [reseller overview](https://router.one/llm-api-reseller) walks through the full setup.

## Why spend caps are the load-bearing part

Reselling without per-key ceilings is a liability machine: one customer's runaway agent drains the shared balance and takes every other customer down with it. Caps turn that systemic risk into a per-customer inconvenience — the runaway key hits its limit and returns 402/429 errors — see the [error-code reference](https://router.one/llm-api-error-codes) — while everything else keeps serving. The same mechanism bounds the damage if a customer leaks their key.

The second load-bearing part is attribution you can show. Per-request traces record model, tokens, cost, and latency per key, which means a customer disputing a bill can be answered with data rather than assertions. The [cost tracking](https://router.one/llm-cost-tracking) page describes exactly what the ledger records.

## What this pattern does not give you

Be straight with yourself and your customers about the boundary. Key-level reselling on Router One does **not** include:

- **White-label or custom branding** — your customers' requests run against Router One's endpoints, not an API surface with your name on it.
- **Sub-accounts or organizations** — keys live in your single account; there is no customer login, seat management, or role system to hand out.
- **Wholesale or volume pricing** — you buy at the posted token line like every other account.
- **Customer-facing billing** — invoicing your customers, taxes, and payment collection are your job, in your tooling.

If your business needs those things, you need a different class of product (or a direct conversation about enterprise terms). Pretending key-level controls are a white-label platform is how resellers end up making promises their infrastructure can't keep.

One adjacent note: Router One also has a separate [referral program](https://router.one/referrals) (5% on referred usage). That's a lighter-weight option if what you actually want is to recommend infrastructure rather than operate it.

## FAQ

**How does reselling LLM API access with spend-capped keys work?**
On Router One you create one API key per customer, set its maxSpend cap to match what that customer prepaid you, and hand over the key or embed it server-side in the tool you run for them. Per-key usage — requests, tokens, spend — shows in the dashboard in real time, and the [reseller overview](https://router.one/llm-api-reseller) walks through the full setup.

**What happens when a customer's spend cap is reached?**
That customer's key hits its limit and returns errors, while your wallet and your other customers are unaffected and everything else keeps serving. You re-bill, raise the cap, and repeat — the same mechanism also bounds the damage if a customer leaks their key.

**Does Router One offer white-label branding or wholesale pricing to resellers?**
No. Key-level reselling does not include white-label or custom branding, sub-accounts, wholesale or volume pricing, or customer-facing billing — you buy at the posted token line like every other account, and your customers' requests run against Router One's endpoints. How to build your own white-label layer on top of Router One — your brand and billing, a managed upstream underneath — is covered in the [white-label guide](https://router.one/white-label-llm-api); how volume buying actually works without a wholesale price list is covered on the [wholesale page](https://router.one/wholesale-llm-api).

**How do I handle a customer who disputes their bill?**
With data: per-request traces record model, tokens, cost, and latency per key, so a disputed bill can be answered with data rather than assertions. The [cost tracking](https://router.one/llm-cost-tracking) page describes exactly what the ledger records.

**Is there a lighter option than operating keys for customers?**
Yes — Router One has a separate [referral program](https://router.one/referrals) (5% on referred usage). It is the lighter-weight option if what you actually want is to recommend infrastructure rather than operate it.

## Who this fits

The key-per-customer pattern fits operators who own the customer relationship and the integration work: agencies running AI features inside client deliverables, consultants managing a handful of accounts, small tools with metered AI inside. It deliberately doesn't fit anyone promising customers "their own platform" — and that's the point. The capability set is small, but every piece of it is real: managed upstream, hard caps, per-request usage data, and a posted rate you can build a margin on honestly.

Set up the first customer key at [router.one](https://router.one/), and see the [reseller page](https://router.one/llm-api-reseller) for the complete capability list — including the explicit not-provided list. The two companion pieces are [per-key cost attribution](https://router.one/blog/track-llm-api-costs-per-key) and [production fallback behavior](https://router.one/blog/llm-fallback-strategies-production).

## See also

- Canonical page: https://router.one/blog/resell-llm-api-spend-capped-keys
- LLM API Gateway and Routing: https://router.one/llm-api-gateway
- All blog posts: https://router.one/blog
- Models and per-model token rates: https://router.one/models (markdown: https://router.one/models.md)
- Pricing: https://router.one/pricing
- API docs (markdown): https://router.one/docs.md
- Company facts: https://router.one/facts/company.md