Step 1
Before you start
You'll get a private workspace with your real AI spend by team and business unit, budgets and alerts. Plan a 30-minute session with a Microsoft admin and someone who can create AI provider admin keys.
- One of Anthropic or OpenAI is enough to start. Add the other any time.
- Okta is what turns API keys into teams. Without it, you can create teams by hand.
- Ask for admin keys a few days ahead. They often need someone else's approval.
- Paste keys into the app yourself. Never send them to anyone by email or chat.
Step 2
What to prepare
Gather these before the session. Each one is read-only and can be revoked at the provider at any time.
| Tool | What you need | Where to get it | Who can create it |
|---|---|---|---|
| Microsoft Entra ID | Your Tenant ID, plus an admin to approve the app at first sign-in | Entra admin center → Overview → Tenant ID | A Microsoft 365 or Entra admin |
| Anthropic | Admin API key (starts sk-ant-admin01-) | Claude Console → Settings → Admin keys | An org admin on the Claude API. Claude Enterprise seats use a different analytics API that isn't supported yet. |
| OpenAI | Admin key (starts sk-admin-) | platform.openai.com → Organization settings → Admin keys | An organization owner |
| Okta (recommended) | Read-only API token and your company.okta.com domain | Okta Admin → Security → API → Tokens | An Okta admin, ideally from a read-only admin account |
| Slack (optional) | Incoming webhook URL for an alerts channel | A Slack app with Incoming Webhooks turned on | A workspace admin, or anyone if app installs are open |
| Confluence (optional) | API token, account email and company.atlassian.net site | id.atlassian.com → Security → API tokens | Any user who can read the spaces agents should see |
| GitBook (optional) | Personal access token and organization ID | GitBook → Settings → Developer | A GitBook organization member |
Step 3
Connect your tools
The first five steps are the in-app Setup. By the end the Command Center shows your spend by team and business unit, with budgets and alerts.
- 1
Sign in with Microsoft
Open the sign-in link from your Boilerplate contact and choose Sign in with Microsoft. The first admin approves the app for your organization; after that, everyone signs in with their work account and your MFA policies apply.
- 2
Connect your AI provider
An empty workspace opens on Setup. Pick Anthropic or OpenAI, follow the link to its console, create an admin key and paste it. We test the key before saving it, then backfill 90 days of usage and cost. A large organization can take a minute or two.
- 3
Bring in your teams
Connect Okta so groups become teams and personal keys follow their owners. If your team groups share a prefix such as
team-, enter it so only those groups import. No Okta? Tick the teams we suggest from your OpenAI projects and Anthropic workspaces, or type your own, one per line. - 4
Group teams into business units
Give each team a unit such as Technology or Go-to-Market. You can do it while creating teams, or later on Teams & units. The Command Center then rolls spend and budgets up by division.
- 5
Set budgets
Budgets are pre-filled from each team's last 30 days of spend plus 20%. Adjust them and click Save budgets. Every team then shows its month-end forecast against its budget.
- 6
Turn on Slack alerts
Optional. Paste an incoming webhook URL. A test message appears in the channel right away, and every new alert posts there.
- 7
Invite your team
On Members, invite people by work email as Admin (can change settings) or Viewer (read-only). Optionally turn on auto-join so anyone in your organization can join as a Viewer.
- 8
Map what's left
On Teams & units, the Unassigned keys & projects list shows anything we couldn't match. Click Apply suggestions, then choose a team for each remaining key. Anything you're unsure about can stay unassigned for now.
- 9
Review alert rules
On Alerts, the defaults are: a team pacing over 100% of budget, a day at 2.5× its 14-day average, and more than $500 not assigned to a team. Failing connectors and keys due for rotation are always checked.
- 10
Add knowledge sources
Optional. Connect Confluence or GitBook on Connectors. On Knowledge, every space starts off. Enable the spaces you want and scope each to the teams that should use it. The organization-wide switch stays off until you turn it on.
Step 4
Verify your numbers
Setup is done when totals match each provider's own console within a few percent. Check these during the session or the next day.
- Month-to-date spend on Usage & spend, filtered to Anthropic, matches the Claude Console cost page for the same dates. Both use UTC days.
- The same check for OpenAI against its Usage page. OpenAI cost can lag up to a day, so compare through yesterday.
- Token totals by model look right.
- Okta teams and people imported, and keys owned by Okta users landed on the right teams.
- Budget pacing percentages make sense for each team.
- Lowering a team's budget below its projected spend creates an alert, and raising it back resolves it.
Step 5
Keep keys fresh
Every key you connect is encrypted and its age is tracked. Pick a rotation policy and we remind you before keys get old.
- On Connectors → Keys & rotation, choose a policy: every 30, 60, 90 (default), 180 or 365 days.
- Fourteen days before a key reaches that age you get a heads-up; once it's overdue, an alert (and a Slack message if connected).
- To rotate: create a new key at the provider, click Rotate key and paste it. We test the new key first, so a bad key never breaks syncing.
- Then revoke the old key at the provider. The audit log records who rotated which key and when.
- If a key stops working (revoked, expired), the connector shows Failing and raises an alert straight away.
Step 6
Security and data access
Share this with your security team. It covers exactly what we read and how it's protected.
How people sign in
With their Microsoft work account. Your MFA and Conditional Access policies apply, and only people from your organization whom you invite can get in.
What we read
Only usage, cost, directory and space-list endpoints. Never prompts or completions.
How keys are stored
Encrypted at rest with AES-256-GCM. Only the last four characters are ever shown again.
Knowledge sources
Every space starts off, is scoped by team, and sits behind an organization-wide switch.
Revoking access
Revoke any key at the provider and access stops immediately. Disconnecting also deletes that provider's synced data.
Full details
Our security overview covers encryption, sessions, sign-in, logging and how to report a vulnerability.
Step 7
Troubleshooting
Most setup issues come from the wrong kind of key or comparing different date ranges.
| What you see | Why | Fix |
|---|---|---|
| "That doesn't look like an Admin API key" | A regular API key was pasted | Anthropic needs sk-ant-admin01-…, OpenAI needs sk-admin-… |
| "The key was rejected" | The key is wrong, revoked, or missing permissions | Create a new admin key and use Rotate key on Connectors → Keys & rotation |
| "Enter your Okta domain" | The domain included extra text | Enter only company.okta.com |
| Numbers lower than the provider's bill | Different date ranges, time zones, or provider delay | Compare full UTC days through yesterday. Today's data is partial. |
| An "Unattributed" row | Provider cost that couldn't be tied to a key, such as tools or storage | Usually small. Tell us if it's more than a few percent. |
| A connector shows Failing | The last sync failed, often because the key was revoked | The message under it says why. Rotate the key, or fix the cause and click Sync now. |
| A key shows Rotation overdue | It's older than your rotation policy | Create a new key at the provider, rotate it here, then revoke the old one |
| "You haven't been invited to a workspace" | Signed in with Microsoft but no invite yet | Ask a workspace admin to invite your work email, then sign in again |
| "Your Microsoft organization isn't set up" | Your tenant isn't linked to a workspace yet | Send your Tenant ID to your contact so they can link it |
| "Sign-in was cancelled or not approved" | Your organization requires admin approval for new apps | Ask a Microsoft admin to sign in first and approve the app for the organization |
Stuck, or want us on the call?
We'll walk through setup with you. Email Justin.Tackling@boilerplate.fyi.