BYO LLM Key Single-Call Billing Integrity Automation: One Logical Call, One Bill, No Silent Repeats

Most software retrying a failed network call is a reasonable, invisible convenience — the caller pays nothing extra for a request that eventually succeeds on infrastructure they don't see the bill for. That entire assumption inverts the moment the credential belongs to the customer: every single request against their own OpenAI key lands directly on their own invoice, so a retry a customer never asked for and never sees a record of is not a convenience — it's an unauthorized charge, however small, hidden inside SDK behavior nobody explicitly chose.

An SDK's default retry behavior is designed for the common case: a managed, provider-billed API key where an occasional extra request is invisible overhead, not a customer-facing cost. Two independent adapter functions built against the same SDK, each assuming retry orchestration happens in a DIFFERENT layer than itself, is exactly how a default like this survives unnoticed — every layer's own code looks locally correct, and the actual behavior only becomes visible when someone measures the real number of requests reaching the provider during an actual failure, not just checks whether the final call eventually succeeded.

The defect was found by direct production measurement, not code review: a canary run deliberately provoked a 500 error from the (test) provider on the first attempt, and the measurement showed 2 real requests reached the provider — not 1 — while the run's own final status still reported success. The doc recording this states the consequence plainly: "without the exit counter, that run would have passed as a clean canary." In a bring-your-own-key architecture, that silent multiplication lands as an unexplained line on the customer's own provider invoice.

The root cause was a default nobody had turned off: constructing an OpenAI SDK client without declaring `maxRetries` leaves the SDK's own built-in default of 2 in effect, so any transient server error on the first attempt triggers the SDK's own automatic retries, invisibly, before the calling code ever sees a result. Synapse's bring-your-own-key layer has exactly two independent client construction points using this SDK — one for a single-message call used by the platform's simple provider path, and a separate one for the tool-calling agentic loop used by its multi-step reasoning path — and both had the identical gap. Fixing only one would have left the agentic path, arguably the more expensive one per call, with the exact same hole open.

Compounding the defect, the file's own header comment asserted a specific, wrong safety claim: that retry orchestration was handled by a different, existing client layer elsewhere in the system. Checked directly against that other layer's own documentation, the opposite was true for this specific bring-your-own-key path — that layer explicitly declares it does NOT retry internally for this path, expecting the caller to already handle it. Two layers had each assumed the other one was responsible; neither actually was. The fix corrects both the behavior (`maxRetries: 0` set explicitly on both client construction points) and the comment that had been asserting a false safety property.

The verification is deliberately behavioral rather than superficial. A new test intercepts the actual global fetch function — the exact point where the SDK's own transport layer resolves its outbound connection for every new client instance — specifically WITHOUT mocking the SDK package itself, because mocking the whole SDK would hide precisely the internal retry decision the test needs to observe. Against a simulated provider that fails every single time, the test confirms exactly one outbound request reaches the transport layer, not the SDK's default of three. A manual mutation proof recorded alongside the fix confirms the test actually catches a regression: commenting out either `maxRetries: 0` declaration made the corresponding "provider always fails" test fail with 3 fetch calls recorded instead of 1, restoring it returned the suite to green. The fix deliberately left the platform's own separately-billed, managed-key clients untouched — those already declare their own deliberate, intentional retry policy and are not customer-billed bring-your-own paths, so extending this specific fix to them would have been out of scope.

A customer's connected OpenAI key hits a brief server-side hiccup on the provider's end during a single agent response. Before this fix, the SDK's own default retry would have silently sent a second request on that same customer's key the moment the first one failed — a second charge for what looks, from the outside, like one normal response. With `maxRetries: 0` in place, that one logical call either succeeds once or fails once and reports the failure — it never quietly becomes two billed attempts on the customer's own account.

A customer's own connected API key is billed for exactly what they actually asked for — one logical request producing at most one billed request, with no invisible multiplication hiding inside a third-party SDK's own defaults. And because the proof is a behavioral test watching the real transport layer rather than a comment or a mock, a future change that accidentally reintroduces the same gap would be caught by the test suite rather than by a customer noticing an unexplained charge.

This fix is scoped specifically to Synapse's bring-your-own-key OpenAI paths — it does not add or change retry behavior for Centriu's own separately-billed, managed-key model clients, which keep their own already-declared, deliberate retry policy since a retry there does not carry the same customer-billing consequence. A team wanting Synapse to automatically retry a failed BYO call on the customer's behalf will find the opposite by design: a failure is reported once, honestly, rather than silently retried at the customer's own expense.

Leaving a third-party SDK's retry behavior at its own default treats "reasonable for the common case" as good enough everywhere it's used — which quietly breaks the moment the credential behind the call belongs to a customer who sees every request on their own bill. Centriu Synapse instead makes the billing-safe value an explicit, declared setting on every bring-your-own-key call path, verified by a test that watches the real network boundary rather than trusting a comment or a mock to describe what the SDK actually does.