How are teams managing Claude Code / Codex API keys across developers?

We started using Claude Code and Codex heavily in our team.

One thing we ran into quickly is API key management.

Right now we have a few options:

1. Everyone uses their own personal API key
2. Share one team API key
3. Store keys in environment variables via a secrets manager

But each option seems problematic.

Personal keys

1. Hard to track usage across the team
2. No centralized budget control

Shared key

1. No visibility on who used what
2. Hard to debug runaway prompts

Secrets manager

1. Still no usage breakdown

For teams using Claude Code or Codex:

How are you handling:

1. API key management
2. usage tracking per developer
3. preventing accidental cost spikes?

Curious what workflows people have settled on.