A budget caps dollars over a window and answers 402; a rate limit caps RPM/TPM right now and answers 429. Here is how to classify the risk, set each control in the dashboard, and write client code that tells the three rejections apart.
Every request through an LLM gateway clears four independent gates before a provider ever sees it — credit balance, budget cap, RPM/TPM rate limit, and guardrails. Each has its own status code, its own scope, and its own fix.
Checking a balance and then calling a provider is a race, and under the fan-out an LLM gateway is built for it loses. Here is the reserve, settle and release contract as you can observe it — what your balance does on success, on an upstream failure, on a timeout, and when the cost is never knowable.
A budget is a dollar allowance attached to a scope and a window. Here is how to create one on each of the four scopes, which status code each returns when it fires, and how to prove the cap bites before you trust it in production.
Both a throttle and a budget block can arrive as 429, and both an empty balance and a team budget arrive as 402. Branch on the error code, not the status — with backoff, jitter, and idempotent retries.
A rate limit caps velocity, a budget caps total spend, and confusing the two is how a runaway loop burns a month of headroom before anything fires. Here is how RPM and TPM limits resolve per key, team and org, what each 429 means, and why the caller can never raise one.
