Appearance
Connecting platforms
TokenFront currently connects to seven AI platforms:
Support for additional platforms depends on whether that provider offers a way to pull usage and cost data programmatically. Some don't yet. If a platform you use isn't listed, it's likely waiting on that provider, not on us.
A scope note: every connection above is for metered, pay-as-you-go API usage, the kind of key that has a per-token or per-request cost attached to it. TokenFront does not track flat-rate subscription or per-seat plans (a ChatGPT Team seat, a Claude Pro seat, and so on). Providers don't expose that billing data through an API, so there's nothing for TokenFront to connect to for those. See What TokenFront does for more on this.
Why you need an admin-level key, not a regular API key
To connect a platform, TokenFront needs a credential that can read your account's usage and billing data, not one used to make AI calls. Most providers have two separate key types for exactly this reason. Each platform's guide below tells you exactly which one to grab and where to find it. Using the wrong type is the most common setup snag, so it's worth double-checking before you paste anything in.
Whatever key you use, TokenFront only reads usage and cost data with it. It never uses your credentials to make AI calls on your behalf.
Does syncing cost anything on the provider's side?
For two providers, yes. They charge for the APIs that report usage and cost, and each sync uses them with your credential. Those charges are billed by the provider to you, not by TokenFront, and TokenFront's plans don't include or reimburse them:
- Vercel AI Gateway: $5 per 1,000 report queries, roughly $2 to $20 a month depending on how many models you use. See Vercel AI Gateway.
- AWS Bedrock: Cost Explorer and CloudWatch request charges, roughly $1.50 to $2 a month per region. See AWS Bedrock.
OpenAI, Anthropic, OpenRouter, Fireworks AI and xAI don't list a charge for the usage and cost APIs TokenFront reads (as of October 2026). Providers can change their pricing at any time, so your provider's bill is the authoritative record. Pausing or deleting a connection stops its syncs.
None of this involves AI calls: TokenFront never uses your credentials to run a model, so it never spends tokens.
What happens to the key once you paste it in
It's encrypted before it's stored, and only decrypted in memory when TokenFront needs to check in with that provider on a sync. Nobody on our team can read it back out in plain text through the product.
The general steps
- Open Add a connection in TokenFront.
- Pick the provider. Each one gets its own page, with a direct link to the right key page on that provider's site.
- Follow the on-screen steps to generate the right kind of key, then paste it in (each platform's page below walks through this in detail).
- Give the connection a name if you want something more specific than the default. Handy if you'll ever connect two accounts on the same provider.
- Save. TokenFront kicks off an initial sync right away.
A platform you connect is visible to your whole organization, not just you — see Team members if you're setting this up for a group.
How long the first sync takes
The first sync pulls in as much history as your plan keeps (30 days for OpenRouter regardless of plan, see its page for why), so it takes longer than the ones after it: usually 30 to 90 seconds. You'll see a sync indicator on the connection while it's running. After that, TokenFront checks in periodically on its own, and each of those catch-up syncs only needs a few seconds since it's just picking up what's new.
How current the data is
TokenFront is not a real-time meter. It doesn't sit between your apps and your AI providers, and it can't see a request as it happens. It reads the usage and cost data each provider publishes about your account, and that has two delays built in:
- The provider's own reporting delay. Providers publish usage and cost after the fact, on their own schedule. The fastest show new usage within a few minutes; others take several hours, and some can take 12 hours or more, or only finalize a day's detail once that day is over. That delay can vary from day to day, and TokenFront has no control over it.
- TokenFront's sync schedule. Each connection is synced several times a day, and again when you open the dashboard if its data is getting old. You can also run a sync by hand from the connection's page; it picks up whatever the provider has published by then.
So the dashboard, Reports, anomaly alerts and budget alerts all show spend as of the provider's last report, not this second. Recent hours can look low until the provider catches up, and an alert about a spike arrives after the provider has reported it, which may be hours after it started. TokenFront is built to tell you well before the invoice, not to stop a job while it's running. If you need usage cut off at a hard limit, use your provider's own spend limits, where it offers them.
Reading the status
- Connected: working normally. Healthy connections stay quiet — no colour, no badge to check.
- Syncing: a sync is running right now.
- Sync delayed (amber): the provider had a temporary problem (an outage or rate limit, say). Nothing to do; it catches up on its own.
- Key rejected (red): the provider refused the credential. Usually it expired, was revoked, or is the wrong type of key. Open the connection and paste in a fresh key.
- Sync failed (red): the last sync didn't complete for another reason. The connection's page says what went wrong.
- Never synced: the credential is saved and the first import hasn't finished yet.
- No credentials: the connection was added but no key has been entered yet.
- Paused: collection is stopped. Existing history is kept but hidden from reports.
Removing a platform
Deleting a platform connection also deletes the cost records that came from it. If you just want to stop tracking for a while, pause the connection instead: collection stops and its history is hidden from reports, but nothing is deleted, and you can resume it any time.