{"slug":"set-per-user-spending-limits","title":"Set per-user spending limits","tags":["tailscale"],"agent_summary":"Last validated: Apr 9, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Set per-user spending limits\r\n\r\nLast validated: Apr 9, 2026\r\n\r\nAperture by Tailscaleis currently [in alpha](https://tailscale.com/docs/reference/tailscale-release-stages#alpha).\r\n\r\nWhen multiple people use LLMs through Aperture, a single user can consume a disproportionate share of your AI budget. Per-user spending limits give each person an independent budget that refills automatically, so no one exhausts the team's resources.\r\n\r\nAperture uses quota buckets to enforce spending limits. Each bucket has a capacity (maximum balance), a refill rate, and a behavior when the limit is exceeded. Using the `` template variable in the bucket name creates a separate bucket for each person who sends requests through Aperture.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/aperture/how-to/set-per-user-spending-limits\\#prerequisites)\r\n\r\nBefore you begin, ensure you have the following:\r\n\r\n- An [Aperture instance](https://tailscale.com/docs/aperture/get-started) with at least one provider configured.\r\n- Admin access to the [Aperture configuration](https://tailscale.com/docs/aperture/configuration).\r\n\r\n## [Define a per-user quota bucket](https://tailscale.com/docs/aperture/how-to/set-per-user-spending-limits\\#define-a-per-user-quota-bucket)\r\n\r\nOpen the **Settings** page in the [Aperture dashboard](https://tailscale.com/docs/aperture/reference/dashboard) and add a `quotas` section to your configuration. The following example creates a per-user bucket with a $10 capacity that refills at $5 per day:\r\n\r\n```json\r\n\"quotas\": {\r\n \"daily:\": {\r\n \"capacity\": \"$10.00\",\r\n \"rate\": \"$5.00/day\",\r\n \"on_exceed\": \"reject\"\r\n }\r\n}\r\n```\r\n\r\nThe `` template expands to each caller's Tailscale login name at request time. For example, when `alice@example.com` sends a request, Aperture charges the bucket `daily:alice@example.com`. When `bob@example.com` sends a request, Aperture charges `daily:bob@example.com`. Each bucket tracks its balance independently.\r\n\r\nThe `capacity` field sets the maximum balance the bucket can hold. This is also the starting balance. The `rate` field controls how fast the bucket refills. Supported time units are `min`, `hour`, `day`, `week`, and `month` (30 days).\r\n\r\nWhen `on_exceed` is set to `\"reject\"`, Aperture blocks requests that would bring the bucket below zero and returns HTTP 429 with a `Retry-After` header. Currently, `\"reject\"` is the only supported value for `on_exceed`.\r\n\r\n## [Attach the quota to a grant](https://tailscale.com/docs/aperture/how-to/set-per-user-spending-limits\\#attach-the-quota-to-a-grant)\r\n\r\nA quota bucket has no effect until a grant references it. Add a `quotas` entry to the capability in your `grants` section that should enforce the limit:\r\n\r\n```json\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"*\"],\\\r\n \"app\": {\\\r\n \"tailscale.com/cap/aperture\": [\\\r\n { \"role\": \"user\" },\\\r\n {\\\r\n \"models\": \"**\",\\\r\n \"quotas\": [\\\r\n {\"bucket\": \"daily:\"}\\\r\n ]\\\r\n }\\\r\n ]\\\r\n }\\\r\n }\\\r\n]\r\n```\r\n\r\nThis grant applies the per-user quota to all models for all users. When a request matches the grant, Aperture checks the user's bucket balance before forwarding the request.\r\n\r\n## [Scope a quota to specific models](https://tailscale.com/docs/aperture/how-to/set-per-user-spending-limits\\#scope-a-quota-to-specific-models)\r\n\r\nTo limit spending on expensive models while leaving others unmetered, create a quota that applies only to specific model patterns:\r\n\r\n```json\r\n\"quotas\": {\r\n \"opus:\": {\r\n \"capacity\": \"$5.00\",\r\n \"rate\": \"$2.50/day\",\r\n \"on_exceed\": \"reject\"\r\n }\r\n},\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"*\"],\\\r\n \"app\": {\\\r\n \"tailscale.com/cap/aperture\": [\\\r\n { \"models\": \"**\" },\\\r\n {\\\r\n \"models\": \"*/claude-opus*\",\\\r\n \"quotas\": [\\\r\n {\"bucket\": \"opus:\"}\\\r\n ]\\\r\n }\\\r\n ]\\\r\n }\\\r\n }\\\r\n]\r\n```\r\n\r\nIn this configuration, requests to Opus models are metered against the `opus:` bucket, while all other models have no spending limit.\r\n\r\n## [Verify the configuration](https://tailscale.com/docs/aperture/how-to/set-per-user-spending-limits\\#verify-the-configuration)\r\n\r\nAfter saving the configuration, confirm the quota is active:\r\n\r\n1. Send a test request through Aperture.\r\n2. Check the [quota status](https://tailscale.com/docs/aperture/how-to/check-and-refill-budgets) using the API (`GET /api/quotas`) or the **Models** page in the Aperture dashboard. The quota bucket for your user should appear with the correct capacity and a balance reduced by the cost of your test request.\r\n\r\nIf a request exceeds the quota, Aperture returns an error formatted to match the provider's native error format (for example, `rate_limit_error` for Anthropic, `insufficient_quota` for OpenAI). For troubleshooting details, refer to [Troubleshooting Aperture](https://tailscale.com/docs/aperture/troubleshooting).\r\n\r\n## [Next steps](https://tailscale.com/docs/aperture/how-to/set-per-user-spending-limits\\#next-steps)\r\n\r\n- [Set a team-wide budget](https://tailscale.com/docs/aperture/how-to/set-team-budget) to add an organization-level spending cap alongside per-user limits.\r\n- [Check and refill budgets](https://tailscale.com/docs/aperture/how-to/check-and-refill-budgets) to monitor bucket balances and manually add funds.\r\n- Refer to the [quotas configuration reference](https://tailscale.com/docs/aperture/configuration#quotas) for the complete field reference and additional examples.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Set per-user spending limits

\n

Last validated: Apr 9, 2026

\n

Aperture by Tailscaleis currently in alpha.

\n

When multiple people use LLMs through Aperture, a single user can consume a disproportionate share of your AI budget. Per-user spending limits give each person an independent budget that refills automatically, so no one exhausts the team's resources.

\n

Aperture uses quota buckets to enforce spending limits. Each bucket has a capacity (maximum balance), a refill rate, and a behavior when the limit is exceeded. Using the <user> template variable in the bucket name creates a separate bucket for each person who sends requests through Aperture.

\n

Prerequisites

\n

Before you begin, ensure you have the following:

\n\n

Define a per-user quota bucket

\n

Open the Settings page in the Aperture dashboard and add a quotas section to your configuration. The following example creates a per-user bucket with a $10 capacity that refills at $5 per day:

\n
\"quotas\": {\r\n  \"daily:<user>\": {\r\n    \"capacity\": \"$10.00\",\r\n    \"rate\": \"$5.00/day\",\r\n    \"on_exceed\": \"reject\"\r\n  }\r\n}\n
\n

The <user> template expands to each caller's Tailscale login name at request time. For example, when alice@example.com sends a request, Aperture charges the bucket daily:alice@example.com. When bob@example.com sends a request, Aperture charges daily:bob@example.com. Each bucket tracks its balance independently.

\n

The capacity field sets the maximum balance the bucket can hold. This is also the starting balance. The rate field controls how fast the bucket refills. Supported time units are min, hour, day, week, and month (30 days).

\n

When on_exceed is set to \"reject\", Aperture blocks requests that would bring the bucket below zero and returns HTTP 429 with a Retry-After header. Currently, \"reject\" is the only supported value for on_exceed.

\n

Attach the quota to a grant

\n

A quota bucket has no effect until a grant references it. Add a quotas entry to the capability in your grants section that should enforce the limit:

\n
\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"*\"],\\\r\n    \"app\": {\\\r\n      \"tailscale.com/cap/aperture\": [\\\r\n        { \"role\": \"user\" },\\\r\n        {\\\r\n          \"models\": \"**\",\\\r\n          \"quotas\": [\\\r\n            {\"bucket\": \"daily:<user>\"}\\\r\n          ]\\\r\n        }\\\r\n      ]\\\r\n    }\\\r\n  }\\\r\n]\n
\n

This grant applies the per-user quota to all models for all users. When a request matches the grant, Aperture checks the user's bucket balance before forwarding the request.

\n

Scope a quota to specific models

\n

To limit spending on expensive models while leaving others unmetered, create a quota that applies only to specific model patterns:

\n
\"quotas\": {\r\n  \"opus:<user>\": {\r\n    \"capacity\": \"$5.00\",\r\n    \"rate\": \"$2.50/day\",\r\n    \"on_exceed\": \"reject\"\r\n  }\r\n},\r\n\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"*\"],\\\r\n    \"app\": {\\\r\n      \"tailscale.com/cap/aperture\": [\\\r\n        { \"models\": \"**\" },\\\r\n        {\\\r\n          \"models\": \"*/claude-opus*\",\\\r\n          \"quotas\": [\\\r\n            {\"bucket\": \"opus:<user>\"}\\\r\n          ]\\\r\n        }\\\r\n      ]\\\r\n    }\\\r\n  }\\\r\n]\n
\n

In this configuration, requests to Opus models are metered against the opus:<user> bucket, while all other models have no spending limit.

\n

Verify the configuration

\n

After saving the configuration, confirm the quota is active:

\n
    \n
  1. Send a test request through Aperture.
    2. \n
  2. Check the quota status using the API (GET /api/quotas) or the Models page in the Aperture dashboard. The quota bucket for your user should appear with the correct capacity and a balance reduced by the cost of your test request.
    3. \n
\n

If a request exceeds the quota, Aperture returns an error formatted to match the provider's native error format (for example, rate_limit_error for Anthropic, insufficient_quota for OpenAI). For troubleshooting details, refer to Troubleshooting Aperture.

\n

Next steps

\n\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}