# Budgets

URL: https://briq.cloud/docs/guides/budgets

> Hand an agent a budget instead of your account.

Every agent has a [policy](https://briq.cloud/docs/concepts/keys-and-policy#the-policy), checked before each create
and start and enforced while its briqs run. A connected client gets one when you approve it, an
API key when you create it. Edit either on the **Agents** page. Nothing can exceed what your plan
allows you, and only a person can create, change or revoke a key: an API key gets `403 forbidden`
on those routes.

## Suggested budgets

| Use                       | `dailySpendCapCents` | `maxConcurrentBriqs` | `allowedSizes`      | `maxSleep` |
| ------------------------- | -------------------- | -------------------- | ------------------- | ---------- |
| Agent on a laptop         | 200                  | 2                    | nano, small         | `"1d"`     |
| CI job                    | 100                  | 3                    | nano, small         | `"1h"`     |
| Shared team key for demos | 1000                 | 5                    | nano, small, medium | `"7d"`     |

A cap is not there to save money; it makes an infinite loop finite.

## Create a key with a budget

On the **Agents** page, or from a signed-in dashboard session:

```bash
curl -X POST https://api.briq.cloud/v1/keys \
  -H "Cookie: …session…" -H "Content-Type: application/json" \
  -d '{
    "name": "claude-code laptop",
    "policy": { "dailySpendCapCents": 200, "maxConcurrentBriqs": 2, "maxSleep": "1d" }
  }'
```

Unset fields take the defaults. An API key cannot create keys or edit a policy (`403 forbidden`),
so an agent never raises its own budget.

## What the agent sees

`briq_quota` returns what is left, so the model can plan. At a limit, `briq_run` fails with
`quota_exceeded` and a message the model relays to you. Crossing the daily cap mid-run stops the
agent's briqs; from the next UTC day they are asleep, and the next use wakes them.

## Rotate and revoke

Give each agent or environment its own key, so you can revoke one without touching the others. Set
`expiresAt` on keys for short-lived environments. The audit log attributes every call to its key.