Monitor without blocking
See every call, its cost, and what your rules would do — without ever blocking a request.
Before you let TokenPolice block anything, you usually want to just watch: see your spend, your per-user costs, and how often your rules would fire — with zero risk to your app. That's the default, and it takes no special setup.
The snippet
Leave the SDK in dry-run (the default). It runs the full check on every call and records what it would do, but never blocks or reroutes:
import token_police as tp
tp.init(
api_key=os.environ["TOKENPOLICE_API_KEY"],
base_url="https://collect.tokenpolice.ai",
firewall="dry_run", # the default — watch, don't act
)import { init } from "token-police";
init({
apiKey: process.env.TOKENPOLICE_API_KEY!,
baseUrl: "https://collect.tokenpolice.ai",
firewall: "dry_run",
});Attach identity as usual so the dashboard can break spend down per user and plan — see
Cap free-tier users for the @tp.workflow pattern.
off is not the same as dry_run. off skips the check entirely and only logs usage, so
you get costs but no "would-block" projections. Use dry_run to preview rules.
Then add rules — still watching
New Block and Reroute rules are created in Dry-run too, so even after you flip the SDK to enforce, each rule keeps only projecting until you switch it over. Nothing is stopped unless both dials say enforce — which is how you roll out one rule at a time. The full truth table is in Dry-run vs enforce.
Watch the projections on the Dry-run tab in your dashboard; when the numbers look right, switch the rules you trust to Enforce.