Grants
For each request, the gateway picks one grant. The most specific match wins, in this order:- User grant
- Organization grant
- Service account grant
- All-users grant
- Bring your own token (BYOT) grant
Callers in more than one organization
When several of a caller’s organizations have grants on the same alias, the gateway bills the grant with the most remaining budget first, and moves to the next one when it runs out. The organization that pays is the one that shows in usage reports. To bill a specific organization, sendX-LLM-Tag-Bill-Org: <org-id>. The gateway ignores the header if the caller isn’t in that organization or the organization has no grant on the alias.
The gateway caches organization membership for 5 minutes by default, so a newly added member may wait a few minutes before an organization grant applies. To change the cache duration, set DOMINO_USER_ORGS_CACHE_TTL_SECONDS. See Environment variables.
Pricing
Each alias uses either the gateway’s built-in price book or custom per-million-token input and output rates. Use custom rates for negotiated pricing or for self-hosted models the price book doesn’t list. Custom rates re-price only the prompt and completion tokens the provider reports. Cached input, reasoning tokens, and image tokens may not be captured, so treat custom-priced budgets as guardrails rather than invoices.Budgets
Two budgets can apply to a request, and both must pass:- An alias ceiling caps total spend through that alias, for every caller, including BYOT.
- A grant budget caps spend for one user, organization, or service account grant. All-users and BYOT grants don’t carry budgets.
0 denies every request.
A user’s budget doesn’t draw from their organization’s budget. If a user with a $200 personal grant runs out, the gateway denies their requests, even if their organization’s grant on the same alias has money left. To force everyone onto a shared pool, clone the alias and put exception users on the copy.
Under heavy concurrent traffic, spend can go slightly over a budget before the gateway logs the requests that crossed it.
Gateway admins
The App owner and any DominoAdmin or SysAdmin can manage providers, aliases, grants, and settings. To give another user admin rights, add them under Access Policies > Gateway Admins. Promoted admins can do everything except change the admin list.
Track usage and cost
Admins see Usage & Cost, covering all traffic. Other users see My Usage & Budgets, the same panel scoped to their own requests.Break down usage
Use Breakdown by to slice the charts and table by model, provider model, user, organization, token name, or any custom tag. Tags come fromX-LLM-Tag-<key>: <value> headers on /v1/* requests. Tag filters narrow the whole panel and combine with AND.
The table shows either aggregate rows, with a $ / 1K tokens column for comparing cost efficiency, or individual requests. Click a request’s cost to see what it’s made of. Charts show the top 8 groups by cost and roll the rest into “Other”. The table lists every group.
Share a view
The panel state lives in the URL, so you can share a view:What users see
On the user view, totals, tag keys, and tag values cover only the caller’s own requests. A link an admin shares shows a user smaller numbers. The user view always reads the gateway’s local data. That data covers the panel’s full 90-day range unless an admin sets log retention below 90 days. See Purge old logs. To query usage from your own Data Source, mirror logs to a warehouse.Related
- LLM Gateway 2.0: what the gateway routes, its endpoints, and how callers make their first request.
- Configure guardrails and fallback routing: move over-budget requests to another alias.
- Deploy and operate LLM Gateway 2.0: back up and purge the logs that usage reads.