HackBlue

Tools · LLM application security · 26 / 27

The max token cap is not the usage

max_tokens is the limit on the request. The completion count is what was metered. Do not copy the cap into the usage field.

10 min read · practice only with authorization

The cap is a request setting

max_tokens on the request is the ceiling the application asked for. It is a number you set before the call. It is not how many tokens the reply used, and it is not a quality score.

A later call can use a different cap. Each request keeps the cap that was on that request.

Usage is what the response metered

The completion token count, when the response includes it, is the usage for that reply. It can be lower than the cap. It can be absent. If it is absent, write that usage was not in the response. Do not substitute the cap.

This page does not raise the cap and does not retry the call. It only stops the two numbers from being swapped.

Both numbers, labeled

File the request id, the max_tokens value, and the completion count if present. A sentence about how much text was metered uses the count. A sentence about the ceiling uses the cap.

Worked case: a cap of 256 filed as the usage

Request req-830 set max_tokens to 256. The response reports 40 completion tokens. A draft says the model used 256 tokens because that was the setting.

The note says the cap was 256 and the metered completion count was 40. The usage line is 40. The cap stays the request setting.

Snippet
request: req-830
max_tokens: 256
completion tokens: 40
write: cap and meter
not: used 256

Diagram

A ceiling and a meter

The setting is not the amount that was counted.

  • max_tokens

    The limit on this request. A setting, not a result.

  • Completion tokens

    What the response metered, when that field is present.

  • Cap higher than usage

    Normal. Do not rewrite the count up to the cap.

  • Usage missing

    Say it was not in the response. Do not borrow the cap.

Check yourself

1. The request sets max_tokens to 256 and the response reports 40 completion tokens. What is 256?

2. Which number is the usage?

3. The response has no completion count. What do you write for usage?