Cap the USOFTA certificate. Keep the provider key.

Set the request ceiling from expected origin-criterion fields and retries, then add optional token, estimated-spend, expiry, and IP bounds when the USOFTA worker needs a tighter envelope.

The USOFTA-certificate job uses a Till key, not an unconstrained provider secret in the worker process. When the job is retired, revoke or let expiry stop that key without rotating every connection.

Till does not issue USOFTA certificates, certify USOFTA origin, or replace a customs authority or issuing body. It is a hosted control layer in front of 12 AI providers: a required request ceiling and optional token, spend, expiry, and IP controls.

Those are plan limits. Public signup is closed; request Pro beta access. Provider inference is billed by the provider. Till charges a platform subscription.

Start with the number of origin extracts, preference-code decisions, or certificate packets the job must process.

Make the required request ceiling large enough for the worker’s documented retries, without turning it into a standing monthly allowance.

Use expiry or revocation when the packet is complete so a finished USOFTA-certificate job cannot keep spending the provider account.