Start with the boundary you already have
A statement of work gives an assessment a beginning, an end and a scope. Your AI credentials should follow the same boundary. Reusing one personal key across every client makes the billing record harder to interpret and leaves more work to do if that key is exposed.
Name it, limit it, expire it
Use a short client reference that does not expose confidential information. Set a budget for the engagement and an expiry that matches the agreed work window. Restrict the key to the models you plan to use. A key budget is a usage control; it does not create prepaid credit or replace account-level limits.
Keep the configuration with the job
Store the tool configuration in the engagement’s private workspace. Keep the credential in a secret or environment variable and out of version control. Before a longer task, run a small connection test and check that the resulting usage appears under the correct key. This is also a useful moment to confirm that your chosen tool is actually supported.
Close out deliberately
Export usage for the agreed date range, check the totals and revoke the key. If you charge the client a markup, show it separately from the underlying API cost. The export supports your invoice; it does not replace it. Automatic expiry is a fallback, not a reason to skip closeout.