The tempting design is a header: `X-End-User: ada@acme.com`, set by the caller, read by the gateway, written to the usage record. It is one line of code and it is wrong.
A header is an assertion. Anything holding the key can set it to anything, which means your usage records are a record of what callers claimed rather than what happened.
Attribution belongs on the credential. One key per end user, minted by the tenant, bound to that person and their wallet at the moment it is created. The caller does not get to say who they are, because the key already did.
It costs a mint per customer. In exchange, every row in the ledger is something you can stand behind.
