Know which team, project and person your AI invoice came from

Provider invoices group AI spend by API key. Grupr Analytics puts a gateway in the path, attributes every request to a department, function, project, person, model and work type, and reconciles the total back to what each provider reports. Finance can explain the number; engineering keeps its tools.

Why the invoice cannot answer the question

Every AI provider bills by credential: an API key, a project, a deployment. None of those is a team. When a board asks what the AI line bought, the answer has to be assembled from key names, guesses and spreadsheets, and it changes every time someone shares a key. The people who could fix it, the engineers, have no reason to; their tools work.

The practical fix is the same one platform teams keep arriving at: give each owner its own credential, put one layer in the path that prices each call and stamps who made it, and treat the provider invoice as the number everything must add up to. Grupr Analytics is that layer, packaged for organizations rather than for one engineering team.

How attribution works

1. A virtual key per team, project or tool

An organization admin issues Grupr virtual keys. Each key carries a department, team, project and work-type tag, an optional list of allowed models and a monthly cap in US dollars. The key maps to the organization’s own provider keys, which Grupr stores encrypted; the provider relationship and its terms stay yours.

2. One environment variable on the developer side

The gateway speaks the OpenAI chat-completions and Anthropic messages formats, so tools that accept a custom base URL (Claude Code, Codex, Cursor, Aider, your own services) point at it with a virtual key and keep working. Each request becomes a usage event: provider, model, prompt and completion tokens, computed cost, latency, status, and the attribution carried by the key.

export ANTHROPIC_BASE_URL=https://api.grupr.ai/api/gateway/anthropic
export ANTHROPIC_API_KEY=gvk_...        # the team's Grupr virtual key
# OpenAI-compatible clients:
export OPENAI_BASE_URL=https://api.grupr.ai/api/gateway/v1

3. People and departments without an identity-provider project

Upload the organization directory as a CSV (person, department, sub-department, function) and user-level events roll up to the hierarchy. No directory sync is required to start; the department on the key is attribution enough for most finance questions.

4. Spend that never touches the gateway

Two more sources feed the same ledger, each labelled so you can tell them apart: an OpenTelemetry metrics endpoint for services you have already instrumented, and connectors that pull provider usage reports for keys that are not routed. Every event records its source: gateway, OpenTelemetry or provider report.

5. Reconciliation to the invoice

For each provider, the reconciliation view shows what the provider reports, what Grupr computed from attributed events, the variance, and the unrouted remainder. Unattributed spend is a number on a page, not a blind spot.

A worked example

Illustrative figures for a 120-person software company in one month; not customer data.

Drill into Engineering and the same table repeats by sub-department, then by project, then by person. Switch the dimension to work type and the tags on the keys (code review, support bot, content, experiments) answer a different question with the same data. The board report prints the department and model tables as a PDF; the explorer exports any breakdown as CSV. The $460 unrouted line comes from the reconciliation view: a key that was never moved behind the gateway, now visible and assignable.

Caps and approvals

Each virtual key has a monthly cap. When a request would exceed it, the gateway answers HTTP 402 with a budget_exceeded error and the caller can file an overage request with an amount and a reason. A department policy can auto-approve small raises; otherwise the request waits for an approver, who approves or denies it with a note and an expiry (end of month by default). Keys can also restrict which models may be called; a call outside the list is refused with 403 model_not_allowed. The full behaviour, including what the person at the keyboard sees, is in Budget controls for AI agents.

Gateway, usage reports or tagging?

Grupr Analytics combines the last row with the first: the gateway attributes and enforces, provider reports reconcile and expose what is not routed.

What it does not see

• Seat subscriptions. Claude Max, ChatGPT Team, Cursor Pro and similar plans are billed per seat and do not use an API key, so no gateway can see them. They appear only where the vendor exposes a usage report Grupr can pull.
• Self-hosted and fine-tuned models are billed as compute, not tokens. Report them through the OpenTelemetry endpoint with your own cost basis or keep them outside this view.
• Key hygiene is the ceiling. A shared key attributes to whoever it was issued to. The reconciliation view shows how much spend is still unrouted so you can decide whether chasing it is worth it.
• Metadata only. The gateway records tokens, model, cost and attribution. It does not store prompts or completions, so it cannot tell you what was asked.

Roles, audit and retention

Organizations have admin, finance and member roles. Changes to keys, policies, connectors and settings are written to an audit log you can read in the app. Retention for usage data is set per organization, with a legal hold that suspends deletion. Grupr Analytics is sold per organization; it is separate from the developer plans on the pricing page.