A spend cap that cannot be overrun
Most API spend limits are checked after the money is spent. MagmaRouter reserves the worst case first and clamps max_tokens, so a key cannot bill past its cap.
The problem with after-the-fact limits
Most limits are checked after a response finishes. On a stream that is seconds later, long enough for one reply to blow through a small cap. Several large providers document exactly this: an organisation-wide limit, tracked with a delay of minutes, that can be overshot. A limit you read after the spend is not a limit; it is a report.
Reserve, clamp, settle
MagmaRouter prices the worst case of a request before it leaves and holds that amount against the key. It then lowers the outbound max_tokens to what the hold covers, so the reply physically cannot cost more. When the response ends it settles the real cost and releases the rest. If the worst case does not fit under the cap at all, the request never leaves.
Caps per key, not per account
Every key can carry a lifetime cap, a monthly cap, or both. Mint one per client, per engagement or per script, and revoke it when the job ends. A leaked key, or an agent stuck in a loop, is bounded by its own cap rather than your whole balance.
The detail is in per-key spend caps and max_tokens clamping.