Your LLM bill, as events

Connect OpenAI and Anthropic with an admin key and get tokens, requests and dollars — per model, per hour — flowing through the same pipeline that delivers your webhooks. Alert on it, warehouse it, join it with the rest of your operation.

In short

Two pull sources — openai and anthropic — read the providers’ own usage and cost APIs on a schedule.
Tokens and money are separate events on purpose: llm.usage_reported per model per settled bucket, llm.cost_reported once per settled day — so summing cost is always the bill, never a multiple of it.
Attribution built in: by model, by provider project (OpenAI), by workspace and API key (both) — turn it on with one config flag.
Set daily_budget_usd on a source and HookGet emails you the day the provider's own settled report crosses it. Deterministic, no AI involved.
Aggregates only. No prompts, no completions — nothing personal leaves your provider account.
Backfill up to 90 days on connect, so the first sync arrives with history.

The data the connectors produce, illustrated: cost per provider per day, each bar backed by llm.usage_reported events carrying tokens, model and cost. Route them to a warehouse, a spreadsheet, an alert — any destination HookGet delivers to.

What one event carries

Field	Example	Note
eventType	llm.usage_reported	one per model per settled bucket
entity	{"type":"model","id":"claude-opus-5"}	the model, so filters group by it
metrics.input_tokens	141201	uncached input
metrics.cached_input_tokens	200	cache reads — the tokens you did not pay full price for
metrics.output_tokens	9756	—
attributes.provider	openai \| anthropic	one filter covers both
attributes.service_tier	standard \| batch	Anthropic: tell batch from interactive
attributes.workspace	support-bot	Anthropic, with group_by_workspace: which product spent it
attributes.provider_api_key	key_abc123	either provider, with group_by_api_key: which key spent it

Money is its own event

Field	Example	Note
eventType	llm.cost_reported	one per provider per settled day
entity	{"type":"provider","id":"anthropic"}	cost reports are org-level; models are a usage concept
metrics.cost_usd	41.25	dollars, converted from each provider’s own unit

Why the split: both providers report usage per (bucket, model) but cost per day. A tool that copies the day's total onto every usage row reports double the bill the moment you sum across two models. Keeping money on its own daily event makes the honest sum the only sum available.

The unit trap, stated so you can check us: OpenAI reports cost in dollars; Anthropic reports lowest currency units as a decimal string — "123.45" means $1.2345. Each connector converts at its own boundary and cost_usd always means dollars. The conversion is covered by a test named after the mistake it prevents.

Three things teams do with it

Goal	How	Destination
A budget alert with no rules to write	Set `daily_budget_usd` in the source config; HookGet emails when the settled day crosses it	email + a pipeline event
A spend alert that fires the day costs jump	Filter `llm.cost_reported` on `cost_usd` above a threshold	Slack / any HTTPS endpoint
Cost per model per day in your warehouse	Route everything, unfiltered	S3-compatible bucket or a queue
One number joining AI cost to the work it did	Land spend events next to your workflow events (n8n source) and divide	your existing analytics

Connect both in two minutes

curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -d '{"provider":"openai","secret":"<openai admin key>","sync_interval_sec":900}'

curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -d '{"provider":"anthropic","secret":"<anthropic admin key>","sync_interval_sec":900}'

Admin keys are stored encrypted, used only by the sync worker, and returned by no API route. A revoked key backs off and pauses with a readable health message instead of retrying forever.

Questions

Is this an LLM observability dashboard?

No, and the page does not pretend it is. HookGet turns your provider spend into events — verified, normalised, retried, replayable — and delivers them wherever you already look: a warehouse, a spreadsheet exporter, a Slack alert, an S3 bucket. If you want charts, point the events at the tool you chart with.

Why events rather than another dashboard?

Because spend data is only useful next to your other data. "Claude cost rose 40%" is a chart; "Claude cost rose 40% the same hour the enrichment workflow started retrying" is an answer — and the second needs your AI spend in the same pipeline as your workflow events, which is exactly what a source gives you.

Does HookGet see my prompts?

No. Both connectors read aggregate reporting APIs: token counts, request counts, model names, dollars. Prompts and completions never leave your provider account, and the events carry containsPii: false honestly.

How fresh is the data?

Buckets are read once they are about 90 minutes settled, because both providers keep writing into the current bucket and double-counting an hour is worse than lagging it. This is cost accounting, not incident response — for outages you already have your own telemetry.