AI spend report
Costs → Analytics opens with the AI spend report, built from what the endpoint collector reports. It answers two questions a provider invoice can’t: who spent it, and would we be better off paying per token?
Two figures, not one
Section titled “Two figures, not one”| Figure | What it means |
|---|---|
| With subscriptions | What AI costs as things are: seats prorated to the selected window, plus anything charged per token. |
| Without subscriptions | What the same usage would cost with no subscriptions, every token at list API rates. |
| Savings | Without minus with. Negative when seats cost more than the usage they cover would have. |
Seats nobody holds are shown separately as spend on seats nobody holds, which is money paid for capacity that isn’t in use.
Costs are cache-aware: cache reads and writes are priced at their own rates, and Claude’s one-hour cache writes (2x input) are priced apart from five-minute ones (1.25x input). Models that charge more for long prompts, such as OpenAI’s GPT-5 family above 272K tokens, are priced at those rates for each request over the threshold. Model prices come from Manage models.
A model with no price of its own is unpriced. It isn’t priced at another version’s rate: Claude Opus 5.5 costs less than Opus 5, and Sonnet 5 less than Sonnet 4.6, so borrowing a neighbour’s price would be wrong in either direction. Only a name with no version (claude-opus) takes the newest priced model of its family.
Coverage
Section titled “Coverage”Every request is put in one of three buckets, and the report shows how it knows:
| Bucket | Rule |
|---|---|
| Covered by a seat | The tool reported a paid plan, and the person holds a seat on a tracked subscription that matches it. |
| Charged per token | No plan was reported, so the request is treated as billed by the token. Overstating is the safer error. |
| Plan, but untracked | The tool reported a paid plan, but no tracked subscription gives this person a seat on it. It’s valued at metered rates and flagged, because its real cost is unknown until the subscription is added. |
Whether a session ran on a subscription or an API key is read from what the tool itself recorded. Claude Code records a billing type and Codex records an auth mode. It isn’t inferred from which tool was used. The same tool can run on a plan in one session and on an API key in the next, and only one of those appears on a bill.
Breakdowns
Section titled “Breakdowns”Every breakdown carries both figures:
- By person: seat cost is attributed to the seat holder’s own row. People who hold a seat but used nothing still appear, so idle seats are visible.
- By machine, by project, by model and by tool: seat cost is split by each row’s share of usage.
Narrow the whole report to one person or one machine, or click through to the Visibility drill-down for projects, models, sites and apps.
Cost against output
Section titled “Cost against output”For each repository, the report shows what it cost beside what the AI wrote in it: lines added and removed, and sessions. Lines come from the tool’s own account of its sessions. They aren’t a diff, and they don’t claim the lines survived review. A tool that doesn’t report what it wrote shows not reported, because no number isn’t the same as no work.
Usage with no price
Section titled “Usage with no price”Requests on a model with no known price are left out of the cost figures rather than counted as $0, so the figures understate spend. The report says so, lists those models with who used them, and links to add a price.
A model a subscription covers, such as codex-auto-review under a ChatGPT sign-in, doesn’t change what is billed, so it doesn’t count against billed spend. It is still listed, marked plan-covered, because the At API prices figure leaves it out.
Known limits of the token counts
Section titled “Known limits of the token counts”- Claude Code sub-agents in the background. A sub-agent that runs in the background often ends without writing its final token count to its transcript; the last line it writes carries a partial output count. Its input and cache tokens are right, but its output tokens are under-counted. Claude Code keeps a per-session cost only for the last session in each project, which can’t be matched to the missing responses, so the collector doesn’t add a correction.
- Usage collected before this change keeps the counts it was sent with: the first-line output counts for Claude Code, and every cache write priced as a five-minute write.
Honest failure
Section titled “Honest failure”If the report fails to load, it says so instead of showing zeros, because zero reads as “spent nothing”. While a new window loads it never shows the previous window’s figures.
Actual against estimate
Section titled “Actual against estimate”Everything above is Shield360’s estimate: what the usage it saw would cost at list rates. The vendors say what they billed. Costs → Actual vs estimate puts the two on the same basis and shows the variance by vendor, by model, by day and by person.
Both sides count API usage only; seats are compared on their own line, because a seat costs its money whether anyone types or not. The estimate is the collector’s metered usage (coding agents on API keys) plus instrumented app traffic (SDK traces) plus the platform’s own model use (Rex, evaluations, Openground). The bill comes from the spend connectors (OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Cursor usage).
The page also says why the two differ:
- spend billed to keys no reporting computer has been seen using;
- spend billed against no key at all (console use, shared workspaces);
- usage the collector saw on no plan and no known key;
- responses priced at zero because the model has no price;
- keys seen on computers that no connected account lists.
A bill reaches a person through the API key a reporting computer was seen using; the estimate reaches a person through the collector. Keys are matched on keyed fingerprints of the part of the key the vendor shows, which the collector computes over the key it sees and Shield360 computes over the vendor’s listing; neither side keeps a character of the key. Costs → API keys shows each key by its name at the vendor, its vendor key id and its fingerprint token ([key_hint:fp_3f9c2a1b]). See Key fingerprints. Where both exist the person’s row shows both. The billed figures are the ones to quote; the estimate is what explains them.