How to limit Gas Manager policy spend?

Last updated: September 4, 2026

Alchemy's Gas Manager provides you with various methods to configure spend limits and allowlists / blocklists for addresses eligible for sponsorship. These can be configured either on our dashboard or via our Gas Manager Admin API endpoints.

  1. Configure Max Spend Per UO: You can configure the maximum amount of USD that can be spent by a single user operation (maxSpendPerUoUsd)

  2. Configure Max Spend Per Account: You can configure the maximum amount of USD that can be spent by a single sender (maxSpendPerSender)

  3. Configure Allowlists / Blocklists: You can configure the list of addresses that are allowed / blocked to receive sponsorship via senderAllowlist and senderBlocklist

  4. Configure Max Spend per Policy: You can configure the maximum amount of USD that can be spent by the Gas Manager for your policy.

All of these spend limits are lifetime, cumulative totals for the policy or sender, not per-day limits. They do not reset on a daily or other recurring basis.

We recommend keeping the default limits that are set when you create a new policy as a starting point, and adjusting them based on your use case. These limits exist to help prevent malicious actors from draining a policy's sponsorship budget.

Setting a per-day limit

Alchemy does not currently offer a built-in per-day (or other time-windowed) spend limit on Gas Manager policies. If you need one, you can track spend on your own side using the Get Sponsorships endpoint, which returns the sponsorship amount, date, and sender address for each sponsored transaction, and enforce your own daily cap through a custom sponsorship rule with a webhook.

Resetting a policy to default limits

There is currently no button to revert a policy's limits back to Alchemy's defaults once you've changed them. To reset to the defaults, deactivate the existing policy and create a new one — new policies start with Alchemy's default limits, which you can then customize again based on your platform's needs.

Protect your API keys and Policy IDs

We highly recommend following good security practices to protect your API key and policy IDs in your application code. Here are some best practices to protect your Alchemy API key:

  1. Use Alchemy provider level settings: Alchemy allows you to configure and restrict the IP addresses or domains that can use the key. More information on this can be found here.

  2. Use secret management tools: Keep your API keys and policy IDs secret using secret management tools like AWS Secrets Manager, Azure Key Vault, HashiCorp Vault or Google Secret Manager. Leaking this information could allow malicious actors to send unauthorized transactions that will be billed to your account.

  3. Encrypt your keys over network requests: Ensure that your API key / policy ID is encrypted over network requests. If your frontend requires access to an API, use a backend proxy to relay requests securely. Avoid logging API keys or policy IDs in their raw form. You can find more information on how to use JWTs for API requests here.

Related docs