improvement(api-keys): move to workspace level

[icecrasher321]

Summary

Move API Keys to workspace level. No concept of pinned api key anymore.

The billed account can be selected in the settings modal.

Cleanup unused columns in workflow table isPublished, marketplaceData, collaborators.

Type of Change

• Other: Platform Improvement

Testing

Tested with different permissions -- different trigger paths.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Oct 30, 2025 6:15pm

[greptile-apps]

Greptile Overview

Greptile Summary

This PR migrates API authentication from workflow-level pinned keys to workspace-level billing accounts. The changes remove the concept of pinned API keys entirely and introduce workspace billing settings.

Key architectural changes:

• Database migration adds workspace.billedAccountUserId (defaults to owner) and workspace.allowPersonalApiKeys (defaults to true)
• Removes workflow.pinnedApiKeyId, workflow.deployedState, and workflow.collaborators columns
• API authentication now resolves through workspace context, checking both workspace keys and personal keys (if allowed)
• Billing attribution for scheduled jobs and webhooks now uses workspace billed account instead of pinned API key owner
• Workspace API token creation/deletion restricted to billed account user only (previously admin/write)
• Frontend simplified deployment flow by removing API token selection UI

Workflow execution changes:

• Schedule execution resolves actor from workspace billed account, falling back to workflow owner
• Webhook processor uses new resolveWorkflowActorUserId helper to determine billing account
• Middleware validates tokens based on workspace settings and user permissions

UI improvements:

• Settings modal adds billed account selector (admins only)
• API settings adds toggle for allowing personal API tokens
• Deploy modal simplified to show "Workspace API keys" or "Personal API keys" label instead of selection dropdown

Confidence Score: 5/5

• This PR is safe to merge with proper testing - clean architectural refactor with comprehensive changes
• Score reflects thorough implementation across all layers (database, backend, frontend) with proper permission checks, migration handles existing data safely by defaulting billedAccountUserId to owner, and authentication logic properly validates workspace settings and user permissions
• No files require special attention - all changes follow consistent patterns and include proper validation

Important Files Changed

File Analysis

Filename	Score	Overview
packages/db/migrations/0102_tidy_human_cannonball.sql	5/5	Migration removes pinned API key concept, adds workspace billing settings (billed_account_user_id defaults to owner, allow_personal_api_keys defaults to true)
packages/db/schema.ts	5/5	Schema updated to remove workflow.pinnedApiKeyId/deployedState/collaborators, adds workspace.billedAccountUserId and workspace.allowPersonalApiKeys
apps/sim/lib/api-key/service.ts	5/5	Refactored authenticateApiKeyFromHeader to check workspace settings and validate personal API key permissions for workspace context
apps/sim/background/schedule-execution.ts	5/5	Changed actor resolution from pinned API key owner to workspace billed account user, falls back to workflow owner
apps/sim/lib/webhooks/processor.ts	5/5	Added resolveWorkflowActorUserId helper to get billed account from workspace, replaced pinned API key logic
apps/sim/app/api/workflows/middleware.ts	5/5	Middleware authentication updated to check workspace/personal keys based on workflow context, removed pinned key validation
apps/sim/app/api/workspaces/[id]/route.ts	5/5	Added PATCH support for updating billedAccountUserId (must be admin) and allowPersonalApiKeys settings
apps/sim/app/api/workspaces/[id]/api-keys/route.ts	5/5	Workspace API key creation/deletion now restricted to billed account user only (was admin/write previously)

Sequence Diagram

sequenceDiagram
participant User
participant UI as Settings UI
participant API as Workspace API
participant DB as Database
participant Workflow as Workflow Execution
participant Auth as Auth Service
Note over User,DB: Configure Workspace Billing
User->>UI: Select billed account admin
UI->>API: Update workspace settings
API->>DB: Validate admin permissions
API->>DB: Set billedAccountUserId
DB-->>API: Success
API-->>UI: Settings updated
Note over User,Auth: Create Workspace Authentication
User->>UI: Create workspace auth token
UI->>API: Request token creation
API->>DB: Verify user is billed account
alt User is billed account
API->>DB: Create workspace token
DB-->>API: Token created
API-->>UI: Success
else User is not billed account
API-->>UI: Access denied
end
Note over Workflow,Auth: Execute Workflow
Workflow->>Auth: Execute with token
Auth->>DB: Get workspace billing config
DB-->>Auth: Config retrieved
alt Workspace token type
Auth->>DB: Validate workspace token
DB-->>Auth: Token authenticated
else Personal token type
Auth->>DB: Check user permissions
Auth->>DB: Validate personal token
DB-->>Auth: Token authenticated
end
Auth->>DB: Get billedAccountUserId
DB-->>Auth: Billed account retrieved
Auth-->>Workflow: Execute with billing attribution

Loading

_{29 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}