Vendor key watch (leaked-key spend alerts)

What it is

Omniscio's other spend alerts only see spend Omniscio made. A leaked key is used somewhere else, so those alerts stay quiet while the bill grows. The one place that sees both is the vendor's own account. The vendor key watch reads that account, subtracts what Omniscio recorded for the same vendor over the same span, and tells you when something is left over.

It is on by default, it only ever reads (it never spends, recharges, or rotates a key), and it costs nothing — every read is a free account call, and no AI tokens are used.

Where to find it

• Inbox — the "Spend on <vendor> that Omniscio didn't make" card, and the "Can't check <vendor>" card.
• Stats → Spend → Vendor key watch — one row per vendor whose key is stored.
• Settings → Notifications → Vendor key watch — the on/off switch, the dollar threshold, and the two optional admin keys.

How it behaves

What you see

• A leak card — when a vendor reports more spend on your key than Omniscio recorded, by more than your threshold ($5 by default) and by more than a fifth of what Omniscio recorded. The card names both figures and when the count started, and its button opens the vendor's own console.
  • One card per vendor, deduped — it never nags.
  • It stays until you dismiss it. It comes back only when the gap grows by another threshold step.
  • Dismissing it starts the count over, so a leak that keeps going raises a fresh card.
• A "Can't check" card — when a vendor's readout fails three times in a row (a revoked key, an outage). It clears itself on the next good read.
• The Stats rows — each vendor shows one of:
  • Matches — the vendor's figure agrees with Omniscio's.
  • Unexplained spend — the gap that raised a card.
  • Starting — the first reading was just taken; figures appear after the next check.
  • Can't check — the readout keeps failing.
  • Not watched — with the reason and, where there is one, the step that would watch it.

Which vendors it can watch

Vendor	What it reads	What you need
DeepSeek, Kimi	the account balance	nothing (a USD-funded account)
OpenRouter	this key's own usage total	nothing
DeepInfra	the account's owed / prepaid figure	nothing
RunInfra	the account's credits	nothing
Anthropic	the usage report for Omniscio's own key	an Anthropic admin key
OpenAI	the cost report for Omniscio's own key	an OpenAI admin key
InferX, GLM, MiniMax, Meta, Qwen, Gemini	—	not watched: the vendor offers no account readout
CrofAI	—	not watched: the vendor has shut down — remove this key

A Claude account you signed into with a browser (a subscription login) has no vendor readout, so it is not part of the Anthropic figure at all — only spend on an API key counts.

The admin keys, in plain words

Anthropic and OpenAI only report spend to an organisation admin key, not to an ordinary key.

• Anthropic: an admin key can manage your whole Anthropic organisation. Create one at console.anthropic.com → Settings → Admin keys, and paste it into Settings → Notifications → Anthropic admin key.
• OpenAI: create a read-only admin key if your organisation offers one, at platform.openai.com → Settings → Admin keys, and paste it into Settings → Notifications → OpenAI admin key.
• Omniscio stores both encrypted, uses them only to read usage, and never shows them anywhere — not in a card, a log, the Stats rows or the command-line route.

Settings

• Vendor key watch (vendorKeyWatchEnabled, default on) — turning it off, from Settings or the command line, takes every open watch card down at once.
• Alert when unexplained spend exceeds (USD) (vendorKeyWatchUnexplainedUsd, default $5, $0–$10,000) — $0 turns the cards off while the Stats rows stay live.
• Anthropic admin key (anthropicAdminApiKey) and OpenAI admin key (openaiAdminApiKey) — optional.

Things that look like a leak but are not

• Two Omniscio installs on one key. Each sees the other's spend as unexplained. The card shows both figures and the span, so you can recognise it; raise the threshold if you share a key on purpose.
• Vendor reporting lag. Anthropic's report runs a few minutes behind, and OpenAI is compared one whole UTC day at a time, so an OpenAI leak surfaces the morning after the day it happened — a lag never raises a card by itself.
• A non-dollar account. A DeepSeek or Kimi account billed in another currency is shown as not watched; it is never converted or compared.

For agents

How it works

• A registered service ticks every 60 minutes (first run ~3 minutes after launch, jittered), reads each watched vendor once per tick, and writes vendor-key-watch-state.json in the user data folder.
• Both sides are running totals compared since a common anchor: unexplained = vendor spent since anchor − Omniscio's out-of-pocket ledger since anchor. The anchor resets on the first reading, when a balance goes up (a top-up) or a total goes down (a reset), after six days, after the owner dismisses a card, and when the vendor key id changes.
• Omniscio's side sums the same three ledger legs the Spend tab uses (sessions, the API charge log, retained session spend), filtered to spend billed to a key — subscription usage never enters it. Sessions and retained spend are running totals; the API charge log is counted only for the span being compared, so its 90-day clean-up can never look like negative spend.
• Anthropic: the vendor figure is the usage report for Omniscio's own key from the anchor to now (minute buckets for the first partial hour, hourly after that), priced with the same pricing function the ledger uses; Omniscio's side counts only the API-key account whose key is read.
• OpenAI: the cost report only has whole UTC days, so both sides cover exactly the same completed days; Codex runs (a ChatGPT subscription) never enter Omniscio's figure.
• A vendor that refuses the readout (a revoked admin key) counts as a failed read and raises the "Can't check" card on the third, rather than going quiet.

Under the hood

• Service: vendor-watch-monitor.ts (started by startup task 1166-vendor-key-watch, stopped in teardown), kill switch AMC_DISABLE_VENDOR_KEY_WATCH=1, inert in an isolated instance.
• The rule: vendor-watch-reconcile.ts (pure).
• The vendor list: vendor-watch-catalog.ts; one reader per vendor under probes/.
• Readout: GET /stats/vendor-watch on the CLI server, IPC channel stats:vendor-watch.
• Cards: dedup prefixes vendor-key-watch: and vendor-key-watch-unreadable:.
• Contract: vendor-key-watch-contract.md; map: vendor-key-watch-map.md.

Related

• ai-spend-alerts.md — the alerts on spend Omniscio itself made.
• kimi-balance-monitor.md — the Kimi low-balance and auto-recharge cards.
• deepseek-balance-forecast.md — the DeepSeek run-out forecast.