Issue: POST /v1/agents/instances/{instance_id}/keys Records Spend Limit But Does Not Enforce It #207
Description
Description
The POST /v1/agents/instances/{instance_id}/keys endpoint allows creating API keys with a specified spend_limit. However, while the spend limit is recorded in the system, it is not being enforced on API key usage.
Current Behavior
- The endpoint accepts and stores a spend_limit value when creating an API key.
- API keys can be used to make requests without any spending restrictions, regardless of the configured spend limit.
- It appears the default behavior is effectively no spend limit, even when a limit is explicitly set.
Expected Behavior
- API keys should be subject to the spend limit specified during creation.
- Once the accumulated usage reaches the configured spend_limit, subsequent requests using that API key should be rejected (e.g., with 429 Too Many Requests or 403 Forbidden).
- The spend limit enforcement should be consistent across all API endpoints that accept these keys.