Skip to content
Xplorr Docs

Connect Cost Sources: OpenAI, Anthropic, Datadog, Snowflake and Databricks

Connect Cost Sources

Section titled “Connect Cost Sources”

Cost sources bring spend that never appears on a cloud bill into Xplorr. Once connected, a source shows up in every cost view, budget and anomaly check, next to your cloud accounts.

ConnectorCategoryWhat it brings in
OpenAIAI APIsModel spend with tokens and requests per project and model
AnthropicAI APIsModel spend with tokens per workspace and model
DatadogObservabilityMonitoring and logging spend per product
SnowflakeData platformsWarehouse spend per account, region and service
DatabricksData platformsLakehouse spend per workspace and SKU

Every connector is read only and needs an admin or billing credential from the provider. Nothing is fetched until you connect one.

Open Cost Sources in the console. Adding, editing and removing sources requires the admin role.

How connecting works

Section titled “How connecting works”
  1. Pick a connector and click Connect.
  2. Give the source a display name and fill in the credentials.
  3. Click Test connection. Xplorr calls the provider immediately and tells you whether the credentials work.
  4. Save. Credentials are tested again before they are stored, so a bad credential never gets saved.

Credentials are encrypted with AES-256-GCM before storage and are never shown again. When you edit a source, secret fields show a “Stored” placeholder; leave them blank to keep the existing value, or enter a new value to replace it.

After the first save, Xplorr immediately backfills the last 30 days. That can take a few minutes.

OpenAI

Section titled “OpenAI”

What to create: an organization Admin API key. Only organization owners can create one, in Organization settings, Admin keys. Project API keys are rejected by the endpoints Xplorr uses.

Field: Admin API key, beginning sk-admin-.

Admin keys have no scopes. Xplorr only calls read endpoints for organization projects, usage and costs.

Xplorr reads usage for completions, embeddings, moderations, images, audio, vector stores and code interpreter sessions, grouped by project and model, plus the organization cost report. It captures input tokens, output tokens, cached input tokens and request counts.

Anthropic

Section titled “Anthropic”

What to create: an organization Admin API key, in Claude Console, Settings, Admin keys. Only organization members with the admin role can create one, and the Admin API is not available for individual accounts, so the key must belong to an organization. Workspace API keys are rejected.

Field: Admin API key, beginning sk-ant-admin01-.

Xplorr reads the organization usage report grouped by workspace and model, and the cost report. Usage that is not attributed to a workspace is recorded as Default workspace.

Datadog

Section titled “Datadog”

What to create: an API key and an Application key, both belonging to the parent organization. Child organization keys are rejected. The application key owner needs the usage_read and billing_read permissions, which the Datadog Admin role grants by default. A scoped key carrying just those two scopes also works. Usage Metering is available on Pro and Enterprise plans.

Fields: Datadog site (defaults to us1), API key, Application key.

Xplorr reads estimated cost and converts the running month to date totals into daily amounts.

Limitation to plan around: Datadog estimated cost only covers the current and previous month. Dates before that are skipped, and Xplorr records a warning saying so. Figures can lag by up to 72 hours, and costs are always recorded in USD.

Snowflake

Section titled “Snowflake”

What to create: a service user with key pair authentication and a role that can read organization billing.

CREATE ROLE xplorr_billing_role;
GRANT DATABASE ROLE SNOWFLAKE.ORGANIZATION_BILLING_VIEWER TO ROLE xplorr_billing_role;
GRANT USAGE ON WAREHOUSE <warehouse> TO ROLE xplorr_billing_role;
GRANT ROLE xplorr_billing_role TO USER <user>;

Run the grants in the organization account, or an account with ORGADMIN enabled, where ACCOUNTADMIN has access by default.

Generate a key pair and set the public key on the user:

Terminal window
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

Then ALTER USER <user> SET RSA_PUBLIC_KEY = '<public key>';

Fields: Account identifier (as MYORG-MYACCOUNT), User, Private key in PKCS#8 PEM, optional Private key passphrase, Warehouse, optional Role, and Data source.

Data source picks which view Xplorr reads:

  • USAGE_IN_CURRENCY_DAILY, the default, with full history
  • FOCUS_COST_USAGE_V1_3, which adds effective (amortized) and list cost but only holds data from 1 January 2026

An X-Small warehouse is enough to run the queries.

Databricks

Section titled “Databricks”

What to create: a principal that can read Unity Catalog system tables, and access to a SQL warehouse.

GRANT USE CATALOG ON CATALOG system TO `<principal>`;
GRANT USE SCHEMA ON SCHEMA system.billing TO `<principal>`;
GRANT SELECT ON SCHEMA system.billing TO `<principal>`;

Unity Catalog must be enabled. System tables are readable by account admins who are also metastore admins. Give the principal CAN USE on the SQL warehouse.

Fields: Workspace URL, SQL warehouse ID, and either OAuth M2M (service principal client ID and secret, the default) or a personal access token.

A serverless warehouse avoids start up waits. The billing system tables are global, so any Unity Catalog enabled workspace in the account returns usage for every workspace.

Limitation to plan around: cost is calculated from the published list price. Negotiated discounts are not visible in Databricks system tables, so the figure is list price rather than what you actually pay. Usage rows with no matching list price are stored with zero cost and Xplorr records a warning.

Syncing

Section titled “Syncing”
  • All connectors sync on one daily schedule, at 04:00 UTC by default.
  • The first sync backfills 30 days.
  • Later syncs refetch a short recent window per connector, between 3 and 5 days depending on the provider, so late corrections are picked up.
  • Each sync replaces data only for the dates the provider actually returned, so a re-sync never double counts.

Admins can click Sync now on a source at any time. Manual syncs are limited to 10 per hour per user, and connection tests to 30 per 15 minutes.

There is no per source schedule setting. Every connector follows the same daily cadence.

Source status

Section titled “Source status”
BadgeMeaning
ConnectedSyncing normally
SyncingA sync is running now
Waiting for first syncConnected, nothing fetched yet
Sync failedThe last sync failed. The error is shown on the card.
No data returnedThe sync worked but the provider returned nothing
Data is staleThe newest data is more than five days old

While a sync is running the page refreshes itself every 10 seconds.

Rotating credentials

Section titled “Rotating credentials”

Click Edit, enter the new secret, and save. Xplorr tests the new credential before storing it, and the next sync uses it. You do not need to disconnect and reconnect, which would delete history.

Disconnecting

Section titled “Disconnecting”

Disconnect deletes the stored credentials and all cost and usage data for that source from Xplorr, along with budgets and alerts scoped to it. Your account at the provider is not changed. Export anything you need first.

Troubleshooting

Section titled “Troubleshooting”

“rejected the credentials”

The key is wrong, revoked, or the wrong type. Each connector needs a specific credential: an organization admin key for OpenAI and Anthropic, parent organization keys for Datadog. Check the key type before regenerating.

“accepted the credentials but denied access”

The credential is valid but lacks permissions. Re-check the grants listed for that connector on its card.

“This source is already connected”

The same provider account is already a cost source in this organization. Edit the existing one rather than adding a duplicate.

No data returned after the first sync

For Datadog, confirm the range is within the current or previous month. For Snowflake and Databricks, confirm the role can actually read the billing views, and that the warehouse is reachable.

A statement did not finish in time

Snowflake and Databricks queries have time limits. A larger or serverless warehouse usually resolves it.

FAQ

Section titled “FAQ”

Are connectors read only? Yes. Each one reads usage and billing endpoints or views and nothing else.

Where does connector spend show up? Everywhere cloud spend does: cost views, budgets, anomaly detection, and reports. AI connectors additionally feed the AI Spend page.

Can I connect more than one account per provider? Yes. Use Add another on the connector card.

Can non-admins see cost sources? They can see sources for accounts they have access to, but cannot connect, edit or disconnect them.

Section titled “Related guides”