AI workloads

OpenAI and Claude application usage

Node.js / TypeScript shared clients support direct non-streaming calls and streamed create calls. Python, Realtime and batch are outside this capability.

A workspace owner sets up one metadata receiver. Your application keeps its provider credentials; this setup needs no provider or admin key. Optional request labels can be added centrally.

Token observations and conditional estimates are separate from reported spend. Modality, tool fees and hidden retries are unverified. An effective, reviewed customer rate card is required; missing model, tier or cache details remain unavailable.

The helper is a private package, not available on npm. Build and distribute the approved workspace packages using the private distribution instructions before using this example.

Setup is unavailable on this deployment. Local SDK fixtures do not activate a production receiver.

pnpm --filter @tokenflow/runtime-metadata build
pnpm --filter @tokenflow/telemetry build
mkdir -p /tmp/tokenflow-private
pnpm --filter @tokenflow/runtime-metadata pack --pack-destination /tmp/tokenflow-private
pnpm --filter @tokenflow/telemetry pack --pack-destination /tmp/tokenflow-private
# In the application checkout, install both supplied archives together:
npm install ./tokenflow-runtime-metadata-0.0.0.tgz ./tokenflow-telemetry-0.0.0.tgz

import type OpenAI from "openai";
import type Anthropic from "@anthropic-ai/sdk";
import type { ResponseCreateParamsNonStreaming } from "openai/resources/responses/responses";
import type { MessageCreateParamsNonStreaming } from "@anthropic-ai/sdk/resources/messages";
import { createMetadataExporter, createUsageObserver,
  extractOpenAiResponse, extractClaudeMessage } from "@tokenflow/telemetry";

// One setup in your shared client module after installing the approved private build.
export function sharedUsage(openai: OpenAI, anthropic: Anthropic,
  endpoint: string, receiverToken: string) {
  const exporter = createMetadataExporter({schemaVersion: 2, endpoint, token: receiverToken});
  const observer = createUsageObserver({exporter, context: {service: {
    name: "answer-service", namespace: null, environment: "production",
    resourceId: null, accountId: null, region: null, repositoryUrl: null, revision: null,
  }}});
  return {
    response: (params: ResponseCreateParamsNonStreaming) =>
      observer.observeOpenAiResponse(() => openai.responses.create(params), extractOpenAiResponse),
    message: (params: MessageCreateParamsNonStreaming) =>
      observer.observeClaudeMessage(() => anthropic.messages.create(params), extractClaudeMessage),
    // Call flush at your own safe point and close during graceful shutdown.
    flush: () => exporter.flush(), close: () => exporter.close(),
    stats: () => exporter.getStats(),
  };
}

Discover current Cloud Run services, jobs and Cloud Functions in selected projects. Billing access is separate. Asset reads alone never establish AI activity or costs.

Your administrator authorizes a dedicated service account for project identity, Cloud Asset search and API consumption, plus narrow federation impersonation. TokenFlow cannot change IAM policies or enable APIs. Disabled APIs require your administrator to act.

Cloud Functions synchronize every seven hours and may arrive later. Cloud Run source freshness is unknown. Inventory remains partial, and missing assets cannot retire confirmed resources.

Container detail, inventory history and Vertex generative audit evidence are unavailable. Folders and organizations are unavailable until their project membership can be verified.

GCP live syncing is not available yet. Access checks run in bounded batches; all selected projects must pass before you can finish connecting.

GCP connection setup is not available yet.

Discover current app resources in selected subscriptions and Resource Groups. Billing access is separate. Inventory remains partial; inner AKS workloads and historical AI callers are unavailable.

Use a dedicated read-only app with subscription identity read and Resource Group permissions for Microsoft.Web/sites/read, Microsoft.App/containerApps/read, Microsoft.ApiManagement/service/read, Microsoft.Resources/subscriptions/resourceGroups/read and Microsoft.Authorization/permissions/read. Your Azure administrator assigns these reads before setup.

Existing gateway logs require separate table access and a separate token audience. Log collection is unavailable until authentication eligibility and table restrictions are verified. Resource reads alone cannot enable logs.

Azure live syncing is not available yet. Access checks run in bounded batches; each selected Resource Group must pass before you can finish connecting.

Azure connection setup is not available yet.

Discover current ECS and Lambda workloads in one account and selected regions. Existing billing access is checked independently. Current roles alone do not identify historical AI callers.

AWS live syncing is not available yet. Inventory and activity coverage remain partial or unknown.

You install the trust and read policies in AWS. TokenFlow makes no IAM changes, model calls, or code downloads. These read permissions may expose environment values; TokenFlow discards them.

AWS connection setup is not available yet.