Token bills fail differently from infrastructure bills. There's no instance to forget to turn off; instead there are retry storms, prompt changes that balloon context, a batch job pointed at the wrong dataset, or a leaked API key. All of them look identical from the invoice: a smooth line, then a cliff. Anomaly detection is about seeing the cliff in minutes-to-hours instead of at month-end — and every platform gives you different raw material to build it from.
Tier 1: Hard thresholds (caps and budgets)
Thresholds are crude but incorruptible. On the first-party Claude API they can actually stop spend, not just report it: usage tiers carry monthly spend caps (Start $500, Build $1,000, Scale $200,000), you can set an organization spend limit below your tier's cap in the Console (Settings > Limits), and workspaces can carry their own monthly spend limits below the organization's. When a cap is hit, API usage pauses until the next month unless you raise the limit. Edge cases to know: no limits can be set on the Default Workspace, and batches may slightly exceed a workspace's configured spend limit due to concurrent processing.
On the 3P platforms there is no Anthropic-side spend cap — Claude Platform on AWS documentation says it directly: spend limits are not available; rely on AWS billing controls. So on Bedrock, Vertex AI, Foundry, and Claude Platform on AWS, tier 1 means your cloud's native budget-and-alert tooling scoped to the account/project/subscription carrying the Claude charges. These alert rather than halt, and cloud billing data aggregates with delay — treat them as the backstop, not the tripwire.
Tier 2: Percentage-change alerts on usage data
The faster signal is usage, not billing. Compare the current window against the same window yesterday or last week, and alert on a relative jump (say, +50%) plus an absolute floor to suppress noise on quiet dimensions. Per platform, the freshest official source:
| Platform | Usage signal to poll or stream |
|---|---|
| Claude API (1P) | Admin Usage & Cost API — token counts by model, workspace, API key in buckets down to 1 minute; data appears within ~5 minutes; recommended sustained polling is once per minute |
| Amazon Bedrock | Model invocation logging records (input.inputTokenCount, output.outputTokenCount, identity ARN) on the bedrock-runtime surface; CloudWatch metrics/alarms on top |
| Vertex AI | token_count metrics in Metrics Explorer (Google notes console Quota-page token usage may be inaccurate — prefer the metrics) |
| Microsoft Foundry | Per-model token and request detail in the Foundry portal's Monitoring tab; the CCU meter in Azure Cost Management for dollars |
| Claude Platform on AWS | No Usage/Cost API — your own response-level usage logs, plus Console Usage/Cost pages for humans |
Wherever the platform signal is thin, the universal fallback works everywhere: log the usage object from every response at your gateway or SDK wrapper (see logging token counts for FinOps) and alert on your own stream. That's also the only tier that can carry your business dimensions — per feature, per customer — rather than per account.
Tier 3: Statistical baselines
Threshold and percentage alerts miss slow leaks and fire on legitimate seasonality (Monday mornings, quarter-end). A statistical baseline — even a simple rolling mean and standard deviation per dimension, alerting beyond two or three standard deviations for consecutive windows — adapts to weekly rhythm and catches gradual drift. Keep the dimensions coarse (team × model, not customer × endpoint) or alert fatigue will bury the real events. Cloud providers also offer managed anomaly-detection features in their cost tooling; whether they can see your Claude charges at useful granularity depends on how your accounts and resources are structured, so verify against your provider's current documentation rather than assuming.
Design the response, not just the alarm
Decide before the pager goes off: who owns a spend alert, what they check first (deploy log, then request-volume vs. tokens-per-request split — the two have different culprits), and what the safe kill switch is. Rate limits are your built-in circuit breaker: on the Claude API, per-workspace rate limits below the org's cap bound how fast any single team can burn, independent of budget alerts. And close the loop with prevention — CI token gates stop per-request cost regressions from ever reaching the dashboard, leaving runtime alerting to do the one job only it can do: catching volume.
Where to go next
Platform billing mechanics are covered in the Bedrock, Vertex, Foundry, and Claude Platform on AWS guides; peak load smoothing addresses the spikes that are real traffic, not anomalies.