Why does my ordinary model key fail?

Admin API rejects standard workspace/inference keys even when owned by an administrator. It requires an Organization-bound Admin Key under existing Enterprise Admin API/Backoffice access. Do not elevate roles or request new grants for monitoring.

Bearer or x-api-key—which is used?

The official OpenAPI downloaded on 2026-10-16 defines AdminApiKey as HTTP Bearer; the Admin authentication handbook instead says x-api-key. Quota Monitor follows the former with Authorization: Bearer only, without fallback or dual headers. Live authentication remains pending user testing; ask official support using non-secret errors if it fails.

Why is this not balance or finalized spend?

usage_limit is the organization monthly cap and total_usage counts toward that cap. remaining is derived cap headroom, not prepaid funds. Quantity reports and price catalogs do not provide a reliable complete money contract, so no tokens-times-price wallet or final-cost estimate is made.

How do disabled, unknown, zero and reached differ?

Explicit no_monthly_limit=true means disabled; a missing flag or amount means unknown; only an explicit valid zero cap means zero. Missing usage never produces invented headroom. monthly_limit_reached is displayed independently, not used to promise universal API availability.

Where are reset times and internal budgets?

spend-limit reports neither reset time nor time zone, so no month-start or renewal is guessed. No low-funds/runway alerts or internal monetary budgets apply. XXX on the binding is a provider-currency sentinel; a successful snapshot displays actual limits.currency.

Can failure overwrite old values, change privileges or incur model charges?

No. Only fixed official GET, with no redirects, login, other-key or limit management, or model calls. Failures preserve the old successful snapshot/time—not a fresh success. Real-account authentication, navigation and reconciliation remain pending user verification.

Mistral AI monthly spend limit & Admin Key setup guide

Awaiting live-account verification

Guide updated 2026-10-16

Implemented against official Admin API OpenAPI reviewed 2026-10-16. The handbook says x-api-key while the current OpenAPI specifies Bearer; this connection follows the latter without header fallback. Real-account authentication, minimum privileges, signed-in navigation and reconciliation await user testing.

Required credentials: Admin API Key bound to the target Organization
Monitoring currency: Official limits.currency · native billing currency, not fixed USD
What is monitored: Organization monthly spending cap · not funds or final costs; Only fixed GET https://api.mistral.ai/v1/admin/spend-limit, Bearer per current OpenAPI; no body, query, redirects or authentication fallback. mistralSpendLimit uses usage_limit only with explicit no_monthly_limit=false, plus total_usage. Amounts use major billing-currency units (500 means 500, never /100). Do not add usage/vibe_usage or estimate from a price catalog. Binding XXX is a provider-currency sentinel; successful snapshots use actual limits.currency.

Check official limits without hosting a privileged key

Select the existing paying Organization in Admin Panel.
Open Subscriptions → Billing and inspect the monthly cap, cap-counted usage and currency separately.
Keep Credits, tax, plans and final invoices separate from cap headroom; do not sum shared keys.
Without Admin API access, stay with manual checking. Do not purchase or request more permissions, or guess unreported reset dates.

Open official Mistral AI · organization spending cap page

Connect Mistral AI · organization spending cap to Quota Monitor

Confirm existing organization and Admin API access
Open official Admin Panel, select the existing Organization that uses the API, then inspect Subscriptions → Billing. Admin Panel, Studio and Backoffice are distinct entry points. This connection reads an organization monthly spending cap, not chat subscriptions or wallet funds.
Continue only with an existing Enterprise organization already provisioned for Admin API and Backoffice. Without access, or if privileged-key hosting is unacceptable, use the manual option below. Do not buy, request new grants or change roles for monitoring.
Open official Mistral AI · organization spending cap page(opens in a new tab)
Understand the privileged key and organization scope
Use an Admin API Key bound to the target Organization—not an ordinary Studio/workspace inference key. An administrator's ordinary inference key is still not an Admin Key. No cross-organization probing is performed.
No billing-read-only scope, permission-checkbox template or importable JSON is documented. Admin Keys can manage organization resources, users, other keys and limits. Naming it Monitor does not make it read-only. Host a separate monitoring credential only within existing access and accepted risk.
Create a dedicated key in your existing Backoffice
In official Backoffice below, open API keys → Create key. Enter a recognizable name such as QuotaMonitorMonthlyCap, select the correct Organization and an optional expiration supported by the current form. Privately save the complete secret shown once.
Do not change roles, supplier permissions, existing application keys or spending caps. Do not copy a key ID, password, Cookie, OAuth token or full Authorization header. Signed-in controls remain pending user verification; Quota Monitor does not log in or create keys for you.
Open official Mistral AI · organization spending cap page(opens in a new tab)
Choose the spending-cap provider in your project
In your Quota Monitor project, add a provider connection, select Mistral AI · monthly spending cap and enter a connection name. An MCP-created secure entry link selects the same type; never send the secret through chat or tool arguments.
Do not enter an organization ID, region, project/key filter or internal monetary budget. Binding currency XXX means use the provider-reported currency at sync, not currency-free amounts or conversion to USD. A Quota Monitor project does not partition the shared cap.
Save only the full secret in the masked field
Paste step 3's complete Admin Key only into the secure entry page's password field, then use Save. Do not include Bearer, x-api-key, a URL or JSON. Syntax validation cannot prove a key has Admin privileges.
Credentials are encrypted; other views show the last four characters only. The public help drawer neither reads nor submits form fields. Close it to continue; discard input if cancelling. Never put keys in screenshots, logs or tickets.
Wait for first success and inspect native-currency values
Wait for first sync or use Refresh allowance/cap, then confirm the successful query time advances. Read monthly cap, cap-counted usage, derived headroom and the independent vendor reached flag. There is no wallet or finalized-cost amount.
For a reported cap of 500 and total_usage=125.5, headroom is 374.5 major units of the native billing currency—not 5.00 or account funds. Disabled caps are labelled disabled; missing data stays not reported, never zero-filled.
Reconcile against the same Organization's Billing
Return to Subscriptions → Billing in the same Organization. Match currency, monthly cap, cap-counted usage and the recent successful query. Compare identical scope; never sum reports from two keys on one organization.
Separate pre-tax monthly caps from tax-inclusive Credits deductions, included plans and PAYG. Only total_usage is read; usage/vibe_usage are not added again. No reset date or time zone is invented. The vendor reached flag is not a guarantee that every API call is blocked.
Open official Mistral AI · organization spending cap page(opens in a new tab)
Troubleshoot without privilege changes or paid tests
For 401/403, check the full Admin Key, organization, expiry/revocation and existing access. Current OpenAPI specifies Bearer but the Admin handbook says x-api-key. This connection sends only the former: no fallback, dual headers or ordinary-key probes. Share only non-secret error codes and the contract discrepancy with official support; do not raise roles or change caps.
Wait before retrying 429. Request/schema failures retain the old snapshot and time. Rotate only an existing monitoring credential through the secure update form; confirm new success before retiring the old monitoring key. Leave application keys alone. Never generate models, top up or buy Enterprise to test monitoring.

What Quota Monitor reads from Mistral AI · organization spending cap

The key is bound to one Organization. Keys, tools and Quota Monitor projects can share its cap: do not sum duplicate reports. This is not a wallet, prepaid Credits, rated costs or final invoice; cap-counted usage is not finalized cost.
no_monthly_limit=true disables the monthly cap, not an unlimited-money grant. Missing flag or cap is unknown, not zero. Only total_usage is read: usage, vibe_usage, token counts and prices never fill missing money.
remaining=max(cap-counted usage,0) and overage=max(counted usage-cap,0) are derived cap headroom/overage only. monthly_limit_reached is independent, not guaranteed model availability. Reconcile pre-tax caps, tax-inclusive credit deductions and separate plans independently.
No reset timestamp or time zone is reported: never infer UTC month start, invoice date or renewal. Query time is not a source watermark. New POST /admin/usage/query returns quantities only; old GET /admin/usage has untyped rows and is not used to estimate money.
Admin API is Enterprise Preview. A normal inference key cannot replace an Admin Key regardless of its owner's role. Official authentication sources conflict; live verification is pending. Failures retain the previous successful value/time. No internal money budgets, low-funds or runway alerts.
The dashboard shows the latest successful allowance or cap snapshot. Refresh cannot remove upstream reporting delays. An old value and timestamp after a failed query are not a new result or a wallet balance.

Mistral AI · organization spending cap FAQ and troubleshooting

Why does my ordinary model key fail?: Admin API rejects standard workspace/inference keys even when owned by an administrator. It requires an Organization-bound Admin Key under existing Enterprise Admin API/Backoffice access. Do not elevate roles or request new grants for monitoring.
Bearer or x-api-key—which is used?: The official OpenAPI downloaded on 2026-10-16 defines AdminApiKey as HTTP Bearer; the Admin authentication handbook instead says x-api-key. Quota Monitor follows the former with Authorization: Bearer only, without fallback or dual headers. Live authentication remains pending user testing; ask official support using non-secret errors if it fails.
Why is this not balance or finalized spend?: usage_limit is the organization monthly cap and total_usage counts toward that cap. remaining is derived cap headroom, not prepaid funds. Quantity reports and price catalogs do not provide a reliable complete money contract, so no tokens-times-price wallet or final-cost estimate is made.
How do disabled, unknown, zero and reached differ?: Explicit no_monthly_limit=true means disabled; a missing flag or amount means unknown; only an explicit valid zero cap means zero. Missing usage never produces invented headroom. monthly_limit_reached is displayed independently, not used to promise universal API availability.
Where are reset times and internal budgets?: spend-limit reports neither reset time nor time zone, so no month-start or renewal is guessed. No low-funds/runway alerts or internal monetary budgets apply. XXX on the binding is a provider-currency sentinel; a successful snapshot displays actual limits.currency.
Can failure overwrite old values, change privileges or incur model charges?: No. Only fixed official GET, with no redirects, login, other-key or limit management, or model calls. Failures preserve the old successful snapshot/time—not a fresh success. Real-account authentication, navigation and reconciliation remain pending user verification.

Official Mistral AI · organization spending cap references

Prepared by Quota Monitor, not an official provider tutorial. Interfaces and permissions may change; check official pages. Verification is limited to the scope stated here.