Track LLM spend per workflow and send budget alerts via the n8n API

Quick overview

This workflow runs every 15 minutes, reads recent n8n executions via the n8n API, extracts LLM token usage from AI and HTTP Request nodes, logs per-call cost into an n8n Data Table, and sends Slack/email/Telegram/webhook alerts for budget overruns, spend spikes, loops, and unpriced models.

How it works

1. Runs every 15 minutes on a schedule.
2. Calls the n8n Public API to fetch execution data since the last saved checkpoint.
3. Extracts LLM calls from execution run data (chat model sub-nodes and raw provider responses from nodes like OpenAI/Anthropic/Google Gemini and HTTP Request), calculates token totals, and estimates USD cost from the configured per-model pricing.
4. Writes only new LLM-call rows into an n8n Data Table using a unique call key to deduplicate across runs.
5. Reads the last 8 days of logged usage and analyzes today’s spend per workflow to detect budget overruns, spikes versus the prior 7-day daily average, excessive calls per execution (loops), and models missing a price.
6. Optionally unpublishes over-budget workflows when configured, then routes each alert to Slack, SMTP email, Telegram, or a custom webhook.

Setup

1. Create an n8n API key and add an n8n API credential, then set your n8n base URL and select the credential for fetching executions and (optionally) unpublishing workflows.
2. Create an n8n Data Table with the required columns (callKey, execution/workflow metadata, token counts, costUsd, estimated, finishedAt) and select it in all Data Table steps.
3. Update the configuration values for model pricing, daily budgets/overrides, spike/loop thresholds, and whether to unpublish over-budget workflows.
4. Choose an alert channel and configure only the matching integration credential (Slack, SMTP, or Telegram) plus destination values (Slack channel, alert email, or Telegram chat ID), or enable and set the webhook URL for webhook alerts.
5. Execute the workflow once and then publish it so the checkpoint and once-per-day alert suppression are persisted across runs.

Requirements

• n8n instance with the public API and Data tables (self-hosted, or a Cloud plan with API access)
• n8n API key
• Credential for your alert channel: Slack, SMTP, Telegram bot, or none for a webhook
• Workflows to monitor must keep their execution data

Customization

• Change the 15 minute interval in Every 15 minutes
• Update pricesPer1M when providers change prices or you add models
• Set per-workflow budgets with budgetOverrides, for example {"workflowId": 20}
• Tune maxCallsPerExecution, spikeMultiplier and spikeMinUsd to match your usage
• Set pauseOverBudget to true to unpublish a workflow that goes over budget
• Add another alert node to the Route alert by channel Switch node

Additional info

Use cases: finding which workflow, node and model spends the most tokens, and catching a looping agent before it burns your budget. Output: one data table row per LLM call, with workflow, node, model, tokens and cost in USD. Limits: the first run reads only the latest 50 executions, each run reads at most 1,000 new executions, and executions waiting in a Wait node are skipped. Calls from HTTP Request and standalone AI nodes are counted only when the node output keeps the provider usage or usageMetadata field. The prices in pricesPer1M are examples, so check your provider pricing pages. Alerts are sent once per day per alert, and this memory is saved only when the workflow is published.