AI FinOps for AWS Bedrock, OpenAI & Anthropic
Follow the money.
Every token of it.
Three providers flow in. Tokkara shows exactly which person, team and model every dollar ends up with, then tells you how to spend less.
No SDK · No proxy · No code changesSee exactly what we access →
Works with the providers you already pay
- AWS Bedrock
- OpenAI
- Anthropic
The problem
The bill grows. The answer doesn't come.
Typical things we hear
The Bedrock line on the AWS bill doubled. Nobody could tell me which team did it.
Head of Platform
Finance wants AI cost per product. I have one invoice from OpenAI and three from AWS.
Finance lead
I'm fairly sure we run Opus on jobs Haiku could do. I just can't prove it.
Engineering manager
The product
One lens over every model you pay for.
One run rate across every provider
Bedrock, OpenAI and Anthropic land in one number, with the trend, the forecast and what moved it.
Run rate
$48,210
+18.4%
Forecast
$52,900
month end
Requests
4.1M
30 days
Spend by model, down to the token
Input, output and cache tokens priced exactly, then reconciled against your AWS bill.
Spend by model · last 30 days
Every dollar has an owner
Attribute cost to people, teams, API keys and projects, using the identities your providers already record. Bedrock traces each call to the IAM identity behind it.
Top spenders · sample handles
Catch what shouldn't be in a prompt
Secrets and personal data flagged in Bedrock prompts during sync. Only the redacted match is kept.
Open findings · sample
Then price the fix
The Savings Engine ranks concrete changes by dollars per month and effort, and tracks what you rolled out.
Ranked savings · sample account
-$14,930/mo
What a first report looks like
From a blurry invoice to a ranked list of fixes.
- monthly AI spend analysed
- $48,210
- addressable by newer models, routing and caching
- 31%
- projected savings
- $14,930/mo
- first report after connecting
- 24h
| Action | Effort | Saving per month |
|---|---|---|
| Move Sonnet 5 traffic to Sonnet 5.5 | Low | $6,180 |
| Stop idle prompt-cache rebuilds in coding sessions | Low | $3,410 |
| Route Claude through the global inference profile | None | $2,940 |
| Compact sessions that carry over 150k tokens of context | Medium | $2,400 |
Estimates use your actual usage. Validate quality on a sample before rolling out a model change.
How we estimate savings
- What we use
- Every Bedrock request from the last 30 days, with its exact input, output and cache tokens, priced at your current rates and projected to a month.
- Newer model upgrades
- The same tokens repriced at the successor model's rates. Successors are newer models in the same family, never a smaller one.
- Global routing
- Requests on in-region Claude inference profiles cost about 10% more than the global profile; the saving is that difference.
- Idle cache rebuilds
- Session turns that rewrote the prompt cache after a 5 to 60 minute pause, priced as the gap between cache-write and cache-read rates.
- Long context
- Cache-read tokens beyond 150k per turn: the spend you could avoid by compacting earlier.
- Assumptions
- Traffic stays at the same volume and mix. Opportunities worth $1 a month or less are dropped. After you mark a fix as rolled out, the saving is measured, not estimated.
Savings estimate
What could you save?
Estimate only, based on the levers the Savings Engine checks: newer models, global routing, idle cache rebuilds and long context. Your real figure comes from your own usage in the first report.
How it works
Connected in five minutes. Nothing in your request path.
- 01
Connect
Deploy a read-only IAM role for Bedrock and add usage admin keys for OpenAI and Anthropic. Takes about five minutes.
- 02
We read your logs
Invocation logs and usage APIs you already have. No proxy, no SDK, no code changes.
- 03
Attribute the spend
Usage is matched to people, teams, API keys and models, then priced to the cent.
- 04
Act on it
Budgets, spike alerts, security findings and ranked savings, all in one place.
Before you connect
AWS Bedrock
- Model invocation logging turned on, delivering to an S3 bucket
- Permission to deploy a CloudFormation stack that creates one read-only IAM role
- Cost Explorer enabled, to reconcile against your AWS bill
OpenAI
- An organization owner who can create an admin key
Anthropic
- A Console admin who can create an admin key
Only need one provider? Connect just that one.See every permission
Why not a gateway?
Visibility without standing in the way.
Gateways and proxies see spend by routing every request through themselves. Tokkara reads the records your providers already keep.
| Aspect | Gateway or proxy | Tokkara |
|---|---|---|
| Setup | SDK or base-URL change in every service | Connect your accounts; about five minutes |
| Latency added | A network hop on every request | None; logs are read after the fact |
| Code changes | Required | None |
| If the vendor is down | Requests can fail or queue | Your traffic is never touched |
| Where prompts go | Through the vendor's servers | Never routed through us; Bedrock logs are read after the fact with your permission, and only redacted findings are kept |
Built for every seat
One source of truth, four ways to read it.
AI cost per team and product, every month
- Monthly reports ready for the close
- Budgets with 80% and 100% alerts
- Forecasts before the invoice arrives
Capabilities
Everything between the invoice and the fix.
Cost attribution
Attribute cost to people, teams, API keys and projects, using the identities your providers already record.
Savings Engine
Ranked fixes priced in dollars per month.
Budgets & alerts
Thresholds and spikes to Slack or email.
Security findings
Secrets and personal data flagged in Bedrock prompts.
Monthly reports
Rollout tracking and proven savings.
SSO & teams
SAML/OIDC sign-in and role-based access.
Privacy controls
Choose what's stored; every admin change is audited.
Pricing
Start free. Pay when it pays for itself.
Starter
Free
for your first assessment
- One connection per provider
- Overview, spend and people views
- First report and savings assessment
Team
Most popularContact sales
priced on AI spend analysed
- Everything in Starter
- Budgets, alerts and security findings
- Savings Engine with rollout tracking
- Monthly reports
Enterprise
Custom
for regulated and multi-account orgs
- Everything in Team
- SSO, teams and audit log
- Privacy controls
- Priority support
FAQ
Questions, answered.
Do I need to change my application code?
No. Tokkara reads the logs and usage data your providers already produce. There's no SDK, proxy or gateway in the request path.
What access does Tokkara need?
A read-only IAM role for AWS Bedrock, plus admin keys for OpenAI and Anthropic. Those providers only expose usage data to admin keys; Tokkara only calls their usage and directory read endpoints. Every permission is listed on our Trust page, and you can revoke access at any time.
How is cost attributed to people for each provider?
Bedrock: to the IAM user or assumed-role session behind each call. OpenAI: to the user who owns the key, otherwise the API key or project. Anthropic: to the Console user for Console usage, otherwise the API key or workspace. Map any of these to teams.
Do you store prompts?
No prompt text by default. Prompt scanning reads Bedrock prompts during sync and keeps only redacted matches. First-prompt previews for Claude Code sessions are off by default for new organizations, and every admin change is recorded in the audit log.
Which regions are supported?
Bedrock sync reads invocation logs in whichever AWS region you enabled them. Our hosting region is available on request.
How long do you retain data?
90, 180, 365 or 730 days, or forever; you choose. Usage, sessions and findings older than that are deleted daily.
How do I revoke access?
Delete the CloudFormation stack for Bedrock and revoke the admin keys in the OpenAI and Anthropic consoles. Tokkara loses access immediately. Step-by-step instructions are on the Trust page.
What happens if a provider changes its log format?
Records we can't parse are skipped, never guessed. The provider card shows the sync error so you know, and we update the parser.
How accurate are the costs?
Tokens are priced per model, including cache reads and writes, and Bedrock totals are reconciled against your AWS bill.
Put your AI bill in focus.
No SDK, no proxy and no change to your application. First report within 24 hours of connecting.