feat(billing): allow programmatic workflow execution on the free plan by waleedlatif1 · Pull Request #5678 · simstudioai/sim

waleedlatif1 · 2026-07-14T23:13:35Z

Summary

Lifts the free-plan restriction on programmatic workflow execution now that the bot-signup abuse it guarded against has been handled. This cleanly undoes #5036 (and the deploy-modal gating follow-up from #5055) across every gated surface.

Server (gates removed):

POST /api/workflows/[id]/execute — API-key + public-API 402 gate
/api/mcp/serve/[serverId] — workspace entitlement 402 gate
/api/webhooks/trigger/[path] — generic-webhook 402 gate (incl. the all-generic-all-free fan-out fallback)
Chat embeds — assertChatEmbedAllowed + isFirstPartyOrigin removed from app/api/chat/utils.ts and both call sites
Deleted lib/billing/core/api-access.ts (+ test, + barrel export) and the FREE_API_DEPLOYMENT_GATE_ENABLED env flag / isFreeApiDeploymentGateEnabled

Client:

Deleted the deploy-modal upgrade wall (DeployUpgradeGate, GatedTabContent, footer gating)
Removed the now-consumerless useWorkspaceOwnerBilling hook/fetcher/query key; the /api/workspaces/[id]/owner-billing endpoint + contract stay as reusable billing infrastructure (mirrored by host-context)
Restored pre-gate upgrade copy: Pro feature line back to 'Higher rate limits', free API-endpoint rate-limit column back to '30' (matches RATE_LIMITS.free.apiEndpoint)

Intentionally kept:

validatePublicApiAllowed in the execute route — a separate public-API permission check, not plan gating
Free-tier rate limits (30/min API endpoint) still apply to free workspaces

Testing

tsc --noEmit clean
15 affected route suites (229 tests) + 46 billing/upgrade suites (420 tests) pass
bun run check:api-validation passes
Repo-wide sweep: zero remaining references to the gate, flag, or 402 paywall message

Remove the free-plan paywall on programmatic execution (API-key/public execute, MCP serve, generic webhooks, cross-origin chat embeds) added in #5036. The gate shipped dark behind FREE_API_DEPLOYMENT_GATE_ENABLED to curb bot abuse; with that abuse handled upstream, free workspaces can use the API again (still subject to the free-tier rate limits). - Delete isWorkspaceApiExecutionEntitled / api-access.ts and the FREE_API_DEPLOYMENT_GATE_ENABLED env flag - Ungate the execute, mcp/serve, and webhooks/trigger routes and the chat embed check (assertChatEmbedAllowed removed) - Remove the deploy-modal upgrade wall (DeployUpgradeGate) and the now unused useWorkspaceOwnerBilling client hook; the owner-billing endpoint stays as reusable billing infrastructure - Restore pre-gate upgrade-page copy (Pro feature line, free API endpoint rate-limit column)

vercel · 2026-07-14T23:13:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 14, 2026 11:27pm

cursor · 2026-07-14T23:13:46Z

PR Summary

Medium Risk
Removes billing enforcement on multiple external execution entry points; abuse exposure increases though auth, admission, and free-tier rate limits still apply.

Overview
Removes the free-plan paywall on programmatic workflow surfaces so free workspaces can use API keys, public API execution, MCP serve, generic webhooks, and cross-origin chat embeds without 402/403 plan-gating.

Server: Drops isWorkspaceApiExecutionEntitled checks from workflow execute (API key / public API), MCP authorizeMcpServeRequest, and generic webhook fan-out; deletes assertChatEmbedAllowed from chat GET/POST. Removes lib/billing/core/api-access.ts, the FREE_API_DEPLOYMENT_GATE_ENABLED env var, and related tests/mocks.

Client: Removes deploy-modal upgrade walls (DeployUpgradeGate, owner-plan gating on API/MCP tabs) and the useWorkspaceOwnerBilling hook plus GET /api/workspaces/[id]/owner-billing route/contract.

Copy: Restores free-tier positioning—Pro feature line to “Higher rate limits”, comparison table free API endpoint column to 30 (aligned with existing rate limits). validatePublicApiAllowed and free-tier rate limits are unchanged.

^{Reviewed by Cursor Bugbot for commit cf87db0. Configure here.}

greptile-apps · 2026-07-14T23:15:57Z

Greptile Summary

This PR removes the free-plan paywall from programmatic workflow execution. The main changes are:

Free workspaces can execute workflows through API keys and public API access.
MCP, generic webhook, and chat embed billing gates were removed.
The deploy modal no longer shows the API/MCP upgrade wall.
Unused billing-gate helpers, flags, hooks, endpoint contracts, and tests were deleted.
Upgrade-page copy and free API endpoint limits were restored.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx	Removes the API/MCP upgrade gate and renders the deploy tab contents directly.
apps/sim/app/api/workflows/[id]/execute/route.ts	Removes the paid-plan entitlement check for workflow API execution.
apps/sim/app/api/mcp/serve/[serverId]/route.ts	Removes the workspace billing check before MCP serve authorization.
apps/sim/app/api/webhooks/trigger/[path]/route.ts	Removes the generic webhook paid-plan gate and billing-blocked fallback.
apps/sim/app/api/chat/[identifier]/route.ts	Removes the chat embed billing gate from GET and POST requests.

_{Reviews (3): Last reviewed commit: "style: biome formatting after gate remov..." | Re-trigger Greptile}

…gger Self-review follow-ups: the /api/workspaces/[id]/owner-billing route + contract existed solely for the deploy-modal gate's client hook (deleted here); host-context serves the same ownerBilling data server-side, so the standalone endpoint is dead HTTP surface. workspaceOwnerBillingSchema and the WorkspaceOwnerBilling type stay (embedded in workspaceHostContextSchema). Also removes the now-unused ChatAuthUtils logger.

waleedlatif1 · 2026-07-14T23:23:19Z

@greptile

waleedlatif1 · 2026-07-14T23:23:21Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b812dd0. Configure here.}

waleedlatif1 · 2026-07-14T23:43:20Z

@greptile

waleedlatif1 · 2026-07-14T23:43:21Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cf87db0. Configure here.}

vercelBottemporarily deployed to Preview July 14, 2026 23:13 Inactive

greptile-appsBot reviewed Jul 14, 2026
View reviewed changes

Comment thread...]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx

vercelBottemporarily deployed to Preview July 14, 2026 23:23 Inactive

cursorBot reviewed Jul 14, 2026
View reviewed changes

style: biome formatting after gate removal
cf87db0

vercelBottemporarily deployed to Preview July 14, 2026 23:27 Inactive

waleedlatif1 merged commit 515dafa into stagingJul 14, 2026
16 checks passed

waleedlatif1 deleted the lift-free-api-exec-gate branch July 14, 2026 23:33

cursorBot reviewed Jul 14, 2026
View reviewed changes

waleedlatif1 mentioned this pull request Jul 15, 2026
v0.7.36: mothership secrets resolution, SEO, service accounts for various providers, library updates, platform and solutions pages #5686
Merged

Navigation Menu

Uh oh!

feat(billing): allow programmatic workflow execution on the free plan - #5678

feat(billing): allow programmatic workflow execution on the free plan#5678
waleedlatif1 merged 3 commits into
stagingfrom
lift-free-api-exec-gate

waleedlatif1 commented Jul 14, 2026

Uh oh!

vercelBot commented Jul 14, 2026•
edited
Loading

Uh oh!

cursorBot commented Jul 14, 2026•
edited
Loading

Uh oh!

greptile-appsBot commented Jul 14, 2026•
edited
Loading

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursorBot left a comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursorBot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Jul 14, 2026

Summary

Testing

Uh oh!

vercelBot commented Jul 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursorBot commented Jul 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-appsBot commented Jul 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercelBot commented Jul 14, 2026•
edited
Loading

cursorBot commented Jul 14, 2026•
edited
Loading

greptile-appsBot commented Jul 14, 2026•
edited
Loading