Run your own spend lake

One bucket you own. Small collectors you deploy. A browser page that reads them. You run every piece, and nothing is sent anywhere else.

About 30 minutes for your first vendor, minutes for each one after.

This guide walks you through:

• Creating one R2 bucket you own to hold every vendor's data.
• Deploying a collector — a small cron Worker that writes a daily cost rollup to it.
• Adding a read-only token + CORS so your browser can read the bucket directly.
• Opening the viewer and seeing all your AI + cloud spend in one page.

Prerequisites

1. Create a Cloudflare account. Sign up if you don't have one, then add the $5/month Workers Paid plan (dash → Workers & Pages → Plans). The free tier caps cron triggers and CPU too low for a multi-vendor fleet.
2. Install Node.js 18+. It gives you npx, which runs Cloudflare's wrangler CLI as npx wrangler — no separate install. Sign in once with npx wrangler login.
3. Have an account with each vendor you want to track, and the ability to mint a read-only billing credential there. Step 2's table lists exactly which key each vendor needs (and any gotchas, e.g. OpenAI/Anthropic need an Admin key; Anthropic needs a Team/Org).

New to Cloudflare Workers & R2?

Workers run your collectors on a schedule; R2 is Cloudflare's S3-compatible object storage with zero egress — which is exactly why your browser can read it directly, with no server of ours in the middle. The $5/mo Workers Paid plan covers both; a real multi-vendor fleet uses under 1% of what it includes, so there's no usage bill to watch.

1Make the bucket you own

One R2 bucket holds every vendor, each under its own prefix (aws/, fireworks/, …).

npx wrangler r2 bucket create mycloudbills

mycloudbills is just the default — bucket names are unique within your own account, so any name works and won't collide with anyone else's.

2Deploy a collector

A collector is a small folder: a WASM Worker on a Cron Trigger that reads one vendor's billing API and writes a daily rollup to your bucket. Pick a vendor and run three commands:

cd fireworks2parquet/worker
npx wrangler secret put FIREWORKS_API_KEY
npx wrangler deploy

Then run it once instead of waiting for the cron. wrangler deploy prints the Worker's URL — just curl that. It looks like:

curl https://fireworks2parquet.<your-workers-name>.workers.dev

<your-workers-name> is your account's workers.dev name — you pick it once per Cloudflare account (e.g. acme → acme.workers.dev), and every Worker you deploy lives under it. It's not per-Worker, so the simplest thing is to copy the exact URL from the wrangler deploy output.

Available collectors

Collector	Reads	Credential
fireworks2parquet	Fireworks usage + rated cost	FIREWORKS_API_KEY + FIREWORKS_ACCOUNT_ID var
cartesia2parquet	Cartesia credits + agents	CARTESIA_ADMIN_API_KEY
openrouter2parquet	OpenRouter Analytics API	OPENROUTER_API_KEY (management key)
aws2parquet	AWS Cost Explorer, daily by service	AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY
cloudflare2parquet	Cloudflare usage — Workers + R2	CLOUDFLARE_API_TOKEN (Analytics read) + CLOUDFLARE_ACCOUNT_ID var
twilio2parquet	Twilio Usage Records — SMS, voice, numbers	TWILIO_API_KEY_SID + TWILIO_API_KEY_SECRET (or TWILIO_AUTH_TOKEN) + TWILIO_ACCOUNT_SID var
openai2parquet	OpenAI org Costs API, daily by line item	OPENAI_ADMIN_KEY (Admin key — Owner/Admin)
anthropic2parquet	Anthropic Admin Cost Report, daily	ANTHROPIC_ADMIN_KEY — an Admin key (sk-ant-admin…). Requires an Anthropic Team/Organization (convert from an individual account): only then does the Admin keys page exist. Regular (sk-ant-api…) and service (sk-ant-svc…) keys are rejected by the cost API.
subscriptions2parquet	Flat subscriptions / seats (ChatGPT Plus, Claude seat, Cursor…) — amortized daily	No key, no API. Edit subscriptions.json (name + usd_per_month), then deploy. Captures the flat SaaS spend that no usage API reports.

3Let the browser read the bucket

The page reads R2 directly from your browser, so the bucket needs two things.

• CORS on the bucket. Allow your site origin. Methods GET, HEAD. Expose ETag, Content-Length, Content-Range, Accept-Ranges.
• A read-only token. Cloudflare dashboard → R2 → API Tokens → Object Read only, scoped to this one bucket. You'll paste its Access Key ID and Secret into the page.

4Open the page

Go to mycloudbills.com/ai-spend.html. Enter your R2 account id, the bucket name, and the read-only Access Key ID + Secret. The page lists every prefix, pulls the Parquet, and does all the math locally. Your keys never leave the tab.

5Add more vendors

Repeat step 2 for each collector you want. The page picks up new prefixes automatically — no changes to the page, and no changes to the reader.

That's the whole path. Everything below is optional.

What it costs

$5/month, flat. Run the account on the Workers Paid plan and stop thinking about it. That plan includes 250 Cron Triggers, 10M requests, and 30M CPU-ms per month; a real multi-vendor fleet uses under 1% of it, so you never see a usage bill. Each collector's wrangler.toml caps CPU per run (cpu_ms = 1000), so a bug can't run away. The viewer is free — a static page on R2, zero egress, open it as often as you like.

Optional — use a different bucket name

Edit bucket_name in that worker's wrangler.toml before deploying.

Optional — host the page yourself

Run make publish to build the wasm and deploy web/ to Cloudflare Pages (it provides the domain, HTTPS, and correct content-types). The web/ files are fully static, so any static host works too.

Optional — add AWS

Deploy aws2parquet/cloudformation.yaml for a read-only ce:Get* user, then enable Cost Explorer once in the console. This adds about $0.30/month — Cost Explorer bills $0.01 per call on a daily cron.

Optional — add Cloudflare

The token needs Account Analytics: Read (not billing). It's usage-forward: you see Workers requests/CPU-ms and R2 storage/ops trending toward the included limits ("am I about to tip into overages?"), with $0 billed until you do.

Optional — cost-per-task with OpenRouter

OpenRouter returns cost by model. session_id is available if you want to break spend down by task/conversation later.

Optional — add a vendor we don't cover

Any vendor with a billing or usage API can become a collector — see COLLECTORS.md for the full recipe and a paste-ready prompt. The only per-vendor work is mapping that API's response to a daily (day, model/service, cost) rollup.

Learn more

AWS, Cloudflare, Fireworks, Cartesia, OpenRouter, OpenAI, Anthropic, and Twilio are trademarks of their respective owners. MyCloudBills is an independent open-source project and is not affiliated with or endorsed by these providers.