feat(billing): allow programmatic workflow execution on the free plan by waleedlatif1 · Pull Request #5678 · simstudioai/sim

waleedlatif1 · 2026-07-14T23:13:35Z

Summary

Lifts the free-plan restriction on programmatic workflow execution now that the bot-signup abuse it guarded against has been handled. This cleanly undoes #5036 (and the deploy-modal gating follow-up from #5055) across every gated surface.

Server (gates removed):

POST /api/workflows/[id]/execute — API-key + public-API 402 gate
/api/mcp/serve/[serverId] — workspace entitlement 402 gate
/api/webhooks/trigger/[path] — generic-webhook 402 gate (incl. the all-generic-all-free fan-out fallback)
Chat embeds — assertChatEmbedAllowed + isFirstPartyOrigin removed from app/api/chat/utils.ts and both call sites
Deleted lib/billing/core/api-access.ts (+ test, + barrel export) and the FREE_API_DEPLOYMENT_GATE_ENABLED env flag / isFreeApiDeploymentGateEnabled

Client:

Deleted the deploy-modal upgrade wall (DeployUpgradeGate, GatedTabContent, footer gating)
Removed the now-consumerless useWorkspaceOwnerBilling hook/fetcher/query key; the /api/workspaces/[id]/owner-billing endpoint + contract stay as reusable billing infrastructure (mirrored by host-context)
Restored pre-gate upgrade copy: Pro feature line back to 'Higher rate limits', free API-endpoint rate-limit column back to '30' (matches RATE_LIMITS.free.apiEndpoint)

Intentionally kept:

validatePublicApiAllowed in the execute route — a separate public-API permission check, not plan gating
Free-tier rate limits (30/min API endpoint) still apply to free workspaces

Testing

tsc --noEmit clean
15 affected route suites (229 tests) + 46 billing/upgrade suites (420 tests) pass
bun run check:api-validation passes
Repo-wide sweep: zero remaining references to the gate, flag, or 402 paywall message

Remove the free-plan paywall on programmatic execution (API-key/public execute, MCP serve, generic webhooks, cross-origin chat embeds) added in #5036. The gate shipped dark behind FREE_API_DEPLOYMENT_GATE_ENABLED to curb bot abuse; with that abuse handled upstream, free workspaces can use the API again (still subject to the free-tier rate limits). - Delete isWorkspaceApiExecutionEntitled / api-access.ts and the FREE_API_DEPLOYMENT_GATE_ENABLED env flag - Ungate the execute, mcp/serve, and webhooks/trigger routes and the chat embed check (assertChatEmbedAllowed removed) - Remove the deploy-modal upgrade wall (DeployUpgradeGate) and the now unused useWorkspaceOwnerBilling client hook; the owner-billing endpoint stays as reusable billing infrastructure - Restore pre-gate upgrade-page copy (Pro feature line, free API endpoint rate-limit column)

vercel · 2026-07-14T23:13:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 14, 2026 11:27pm

cursor · 2026-07-14T23:13:46Z

PR Summary

Medium Risk
Removes billing enforcement on multiple external execution entry points; abuse exposure increases though auth, admission, and free-tier rate limits still apply.

Overview
Removes the free-plan paywall on programmatic workflow surfaces so free workspaces can use API keys, public API execution, MCP serve, generic webhooks, and cross-origin chat embeds without 402/403 plan-gating.

Server: Drops isWorkspaceApiExecutionEntitled checks from workflow execute (API key / public API), MCP authorizeMcpServeRequest, and generic webhook fan-out; deletes assertChatEmbedAllowed from chat GET/POST. Removes lib/billing/core/api-access.ts, the FREE_API_DEPLOYMENT_GATE_ENABLED env var, and related tests/mocks.

Client: Removes deploy-modal upgrade walls (DeployUpgradeGate, owner-plan gating on API/MCP tabs) and the useWorkspaceOwnerBilling hook plus GET /api/workspaces/[id]/owner-billing route/contract.

Copy: Restores free-tier positioning—Pro feature line to “Higher rate limits”, comparison table free API endpoint column to 30 (aligned with existing rate limits). validatePublicApiAllowed and free-tier rate limits are unchanged.

^{Reviewed by Cursor Bugbot for commit cf87db0. Configure here.}

greptile-apps · 2026-07-14T23:15:57Z

Greptile Summary

This PR removes the free-plan paywall from programmatic workflow execution. The main changes are:

Free workspaces can execute workflows through API keys and public API access.
MCP, generic webhook, and chat embed billing gates were removed.
The deploy modal no longer shows the API/MCP upgrade wall.
Unused billing-gate helpers, flags, hooks, endpoint contracts, and tests were deleted.
Upgrade-page copy and free API endpoint limits were restored.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx	Removes the API/MCP upgrade gate and renders the deploy tab contents directly.
apps/sim/app/api/workflows/[id]/execute/route.ts	Removes the paid-plan entitlement check for workflow API execution.
apps/sim/app/api/mcp/serve/[serverId]/route.ts	Removes the workspace billing check before MCP serve authorization.
apps/sim/app/api/webhooks/trigger/[path]/route.ts	Removes the generic webhook paid-plan gate and billing-blocked fallback.
apps/sim/app/api/chat/[identifier]/route.ts	Removes the chat embed billing gate from GET and POST requests.

_{Reviews (3): Last reviewed commit: "style: biome formatting after gate remov..." | Re-trigger Greptile}

…gger Self-review follow-ups: the /api/workspaces/[id]/owner-billing route + contract existed solely for the deploy-modal gate's client hook (deleted here); host-context serves the same ownerBilling data server-side, so the standalone endpoint is dead HTTP surface. workspaceOwnerBillingSchema and the WorkspaceOwnerBilling type stay (embedded in workspaceHostContextSchema). Also removes the now-unused ChatAuthUtils logger.

waleedlatif1 · 2026-07-14T23:23:19Z

@greptile

waleedlatif1 · 2026-07-14T23:23:21Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b812dd0. Configure here.}

waleedlatif1 · 2026-07-14T23:43:20Z

@greptile

waleedlatif1 · 2026-07-14T23:43:21Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cf87db0. Configure here.}

vercel Bot temporarily deployed to Preview July 14, 2026 23:13 Inactive

greptile-apps Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread ...]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/deploy-modal.tsx

vercel Bot temporarily deployed to Preview July 14, 2026 23:23 Inactive

cursor Bot reviewed Jul 14, 2026

View reviewed changes

style: biome formatting after gate removal

cf87db0

vercel Bot temporarily deployed to Preview July 14, 2026 23:27 Inactive

waleedlatif1 merged commit 515dafa into staging Jul 14, 2026
16 checks passed

waleedlatif1 deleted the lift-free-api-exec-gate branch July 14, 2026 23:33

cursor Bot reviewed Jul 14, 2026

View reviewed changes

waleedlatif1 mentioned this pull request Jul 15, 2026

v0.7.36: mothership secrets resolution, SEO, service accounts for various providers, library updates, platform and solutions pages #5686

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(billing): allow programmatic workflow execution on the free plan#5678

feat(billing): allow programmatic workflow execution on the free plan#5678
waleedlatif1 merged 3 commits into
stagingfrom
lift-free-api-exec-gate

waleedlatif1 commented Jul 14, 2026

Uh oh!

vercel Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Jul 14, 2026

Summary

Testing

Uh oh!

vercel Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

waleedlatif1 commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Jul 14, 2026 •

edited

Loading

cursor Bot commented Jul 14, 2026 •

edited

Loading

greptile-apps Bot commented Jul 14, 2026 •

edited

Loading