Changelog
Product, API, SDK, and documentation changes are grouped by release date. Expand a release to read its details.
2026-09-21Dashboard access and visual consistency
- Made webhook integrations available on every plan with capacity-based limits: three endpoints on Free and grandfathered Launch, ten on Growth, and unlimited capacity on Enterprise.
- Removed webhook and additional-organization paywall cards while retaining server-enforced account capacity limits.
- Added direct API enforcement for webhook and organization creation limits so hidden dashboard actions cannot be bypassed.
- Standardized protected dashboard cards, controls, dialogs, and sheets on square corners while preserving circular avatars and status indicators.
- Refreshed dashboard screenshots used throughout the documentation to match the current product UI.
2026-09-20Public API and Node.js SDK
- Added versioned public API hosts:
api.usagey.com/v1for production andsandbox.usagey.com/v1for sandbox. - Added host-to-key environment enforcement for usage requests and host-scoped provider webhook reconciliation.
- Added API-key-authenticated
/v1/checkoutand Node SDK checkout support for plan assignment and one-time credit-pack purchases. - Added API-key-authenticated
/v1/eventsand typed SDK pagination for developer-event consumption. - Added published, type-checked Node SDK examples for usage, checkout, and developer-event pagination.
- Hardened account-allowance warning delivery with atomic claims, bounded retries, and stale-worker recovery.
- Kept the existing
/api/usage/*handlers as a temporary compatibility bridge.
2026-09-20Pricing, credits, and packaging
- Simplified public pricing to Free, Growth, and Enterprise; Launch remains supported only for existing grandfathered subscriptions.
- Increased the Free allowance from 2K to 5K tracked events per month.
- Added reusable Product Credits and AI Credits templates on top of the generic credit ledger.
- Added inactive pack drafts, credit-system selection, pack editing, and an explicit publish step in Add-ons.
- Prevented zero-price packs from being activated or exposed for new customer purchases.
- Added organization-specific, evidence-gated account quota enforcement with audited approvals and rollbacks.
- Added platform-admin rollout controls that remain locked until account counters reconcile with immutable meter events.
- Added true package/block pricing with configurable units per package, cumulative delta charging, promotion support, and billing-document audit details.
- Migrated the Node.js SDK to the current check/track APIs with typed entitlement decisions, idempotent writes, and a compatibility alias for
UsageyClient.
2026-09-19Proration and seat changes
- Finalized upgrade, downgrade, and seat-change policy; versioned proration previews now show the unused current-plan credit and remaining target-plan charge.
- Added idempotent, pending tax-aware proration transactions for immediate internally managed upgrades and seat increases.
2026-09-14Security and recurring lifecycle
- Added a state-aware recurring provider capability contract across subscription APIs, dashboard management, and the customer portal.
- Added customer self-serve reactivation for supported Stripe and Paystack scheduled cancellations, while pre-announcing unsupported PayPal reactivation and Paystack plan or seat changes.
- Locked V2 tax behavior to manual configuration, added deterministic inclusive/exclusive quotes for manual transaction imports, and preserved immutable tax provenance in invoices and receipts.
- Added an admin-only account-usage reconciliation report that compares shadow counters with immutable consuming meter events and blocks rollout readiness on mismatches, orphan events, overlapping periods, or truncated results.
- Replaced the platform-admin organization's placeholder Usage tab with a read-only quota reconciliation workflow and period-level mismatch evidence.
- Aligned rejected consuming requests with each organization's active subscription period instead of falling back to calendar months.
- Added a visual, searchable OpenAPI reference with endpoint groups, schemas, examples, and JSON download support.
- Extended distributed rate limiting to authentication, password recovery, bot verification, checkout confirmation, and billing API-key creation and rotation.
- Standardized protected-route failures with explicit
429or fail-closed production503responses and rate-limit retry headers. - Added an audited two-phase billing API-key migration workflow with readiness reporting, hash verification, and fail-closed plaintext finalization.
- Changed public API authentication to prefer hashed lookup and self-migrate a legacy key after a successful compatibility lookup.
- Added provider-credential key-ring rotation, stale-envelope readiness reporting, and migration that removes sensitive fields left in public provider configuration.
- Added tenant-scoped billing API-key expiry, revocation, reactivation, and atomic rotation APIs with one-time replacement-secret reveal.
- Replaced the dashboard's legacy API-key screen with a workspace-aware Developer workflow using opaque create/manage sheets, and removed the duplicate key panel from Provider Settings.
- Added forced PostgreSQL RLS policies for Usagey's organization-level commercial control plane without merging it into customer billing-workspace policy.
- Restricted account counters, volume allowances, notifications, economics snapshots, and Enterprise onboarding to the selected organization or explicit audited control-plane work.
- Restricted global infrastructure cost inputs to audited platform-admin transactions with no selected tenant.
- Added organization/workspace consistency checks for immutable platform meter events.
- Moved economics, allowance, Enterprise, and notification operations off unrestricted Prisma access while keeping email delivery outside database transactions.
- Extended CI's non-superuser database proof across commercial organization isolation and global cost visibility.
2026-09-13Tenant isolation and billing operations
- Bound authenticated subscription creation, previews, cancellation, reactivation, and plan changes to operator-scoped tenant transactions.
- Added customer-scoped tenant context for self-serve subscription previews, plan changes, and cancellation.
- Made subscription state, developer events, and idempotency responses commit atomically for local lifecycle operations.
- Added workspace ownership checks for customer, plan, and provider references during subscription creation.
- Replaced fixed-date proration coverage with rolling active-period fixtures so lifecycle tests remain valid over time.
- Migrated authenticated transaction lists, details, receipt generation, manual imports, refunds, and refund retries to operator-scoped tenant transactions.
- Made refund eligibility checks, reconciliation effects, retry linkage, developer events, and idempotency responses atomic for local refund workflows.
- Added a semantic Transactions page heading and retained end-to-end coverage for the complete admin receipt, refund, and retry workflow.
- Bound customer-portal summaries, usage, balances, transactions, invoices, receipts, and subscription ownership checks to customer-scoped tenant transactions.
- Added database-level customer filtering for portal invoice aggregation and excluded uncorrelated shared-provider webhook activity from customer views.
- Bound operator and customer-portal checkout creation and confirmation to tenant-scoped idempotency transactions.
- Added customer ownership checks before provider checkout confirmation and replay-safe one-time credit settlement coverage.
- Migrated provider connection management and Provider Settings rendering to operator-scoped tenant transactions.
- Added secret-preserving provider updates so blank credential fields do not erase the existing encrypted checkout or webhook configuration.
- Moved verified PayPal, Stripe, and Paystack webhook persistence and reconciliation into audited workspace-scoped
SYSTEMtransactions. - Made webhook state changes, refunds, settlements, and developer-event records atomic while preserving failed webhook audits before returning errors.
- Migrated developer-event history, webhook diagnostics, and dashboard event summaries to operator-scoped tenant queries.
- Added cursor pagination plus event-type, status, and text filters to developer-event history while keeping SSE transactions short-lived.
- Migrated dashboard overview, catalog, customer, subscription, transaction, usage, revenue, analytics, settings, and onboarding reads to operator-scoped tenant transactions.
- Bound analytics and operational exports to the selected workspace transaction instead of unrestricted reporting queries.
- Split invoice email delivery into tenant-scoped lookup and audit-write phases so provider email latency never holds a database transaction open.
- Removed readable billing API keys from the Usage dashboard; only secure key fingerprints or a legacy rotation prompt are displayed.
- Bound provider settlement collection and refund allocation to the operator-scoped idempotency transaction, including reconciliation and developer-event writes.
- Added audited
SYSTEMtenant context for internal subscription renewals, invoice issuance, threshold settlement, and compliance-retention cron work. - Kept invoice email-provider calls outside database transactions while retaining tenant-scoped lookup and issuance audit phases.
- Restricted provider-managed renewal discovery to workspace identifiers, then moved subscription loading, optimistic claims, local activation, failures, and developer events into audited per-workspace
SYSTEMtransactions. - Kept Stripe and PayPal renewal API calls outside database transactions while preserving stale-claim recovery.
- Bound customer data exports, deletion audits, customer deletion, and billing-action previews to authenticated operator transactions.
- Added audited system-discovery transactions for cron candidate enumeration, operator workspace resolution, portal identity resolution, and explicit workspace provisioning.
- Tightened the staged PostgreSQL tenant predicate so workspace-scoped
SYSTEMjobs cannot access another workspace; cross-workspace discovery is allowed only when no workspace is selected and an audit reason is present. - Moved legacy catalog backfill into a workspace-scoped system transaction and made environment promotion one atomic, idempotent cross-workspace operation.
- Stopped copying provider connections during Sandbox-to-Production promotion; Production payment credentials must be configured independently.
- Bound workspace overview/settings and rejected-request platform metering to their authenticated tenant transactions.
- Removed unscoped transaction fallbacks from invoice actions, threshold settlement, compliance cleanup, and internal subscription renewals; callers must now supply a tenant context or tenant-bound database client.
- Routed economics snapshots, provider-credential migration, and provider webhook candidate lookup through named audited system-discovery transactions.
- Made billing analytics, reporting, invoice lookup, exports, and provider settlement collection require an injected tenant-bound database client.
- Removed unrestricted checkout, developer-event, and reconciliation fallbacks; provider settlement confirmation now performs tenant-scoped read and write phases around the external provider call.
- Added forced PostgreSQL row-level security policies for the V2 billing workspace tables, including relation-backed plan, credit, entitlement, and settlement records.
- Moved public API-key resolution into audited system discovery and key telemetry into the resolved API-key tenant context.
- Changed CI database setup from schema push to migration deployment so PostgreSQL functions and row-level security policies are installed before tests run.
- Added live tenant-isolation tests through a temporary non-superuser PostgreSQL role, covering operator reads, direct and relation-backed cross-workspace writes, scoped system jobs, and explicit audited discovery.
2026-09-12Tenant context foundation
- Added transaction-local organization, workspace, environment, and actor context to public entitlement and usage writes.
- Bound usage idempotency records to the same authenticated workspace context and rejected mismatched tenant records before database work begins.
- Migrated authenticated catalog reads and writes, plan-entitlement tiers, and default-plan seeding to operator-bound tenant transactions.
- Migrated customer management and manual entitlement overrides to the same operator-bound transaction boundary.
- Added PostgreSQL tenant-policy helper functions while keeping table-level RLS activation staged until all access paths are migrated.
2026-09-11Refunds, portals, and workspace provisioning
- Added multi-capture provider refunds for credit-direction usage settlements, with durable allocation records, pending webhook reconciliation, and duplicate-dispatch protection.
- Changed completed credit settlement aggregates to zero-value audit markers because their refund transactions already represent the cash movement.
- Added dashboard refund-allocation progress and end-to-end Paystack proof for multi-capture credit settlement reconciliation.
- Added effective limit, remaining allowance, reset timing, manual override, and overage-policy visibility to the customer portal.
- Removed production workspace seeding from customer-portal reads; unconfigured portals now return a read-only not-configured response.
- Removed implicit workspace creation from all billing management reads; only authenticated mutation and setup flows can provision an environment workspace.
- Removed plaintext default-key generation from workspace backfill and sanitized API-key metadata returned by workspace overview responses.
- Moved dashboard workspace provisioning out of page rendering and into signup, organization creation, and an explicit environment setup action.
2026-09-10Commercial hardening
- Standardized Usagey account allowances at 2K for Free, 250K for Launch, and 2M for Growth accepted units per month.
- Added idempotent account-level usage metering, shadow-mode enforcement, and warning notifications at 80%, 90%, and 100% usage.
- Added explicit additional-volume grants without publishing or applying an unvalidated overage rate.
- Added fully loaded economics snapshots that separate fixed, variable, and directly attributable infrastructure costs from marginal cost.
- Added one-time API-key reveal with hashed authentication and encrypted payment-provider credential storage.
- Added immediate Stripe plan and seat upgrades with invoiced proration and explicit provider price mappings; unsafe provider-managed scheduled changes remain blocked.
- Added rolling paid-account economics with separate Free-tier capacity reporting and fully-loaded margin guidance.
- Added consecutive-period hard-limit signals for internal upgrade and Enterprise qualification workflows.
- Added two-phase Stripe renewal synchronization for scheduled plan downgrades and seat decreases without granting local entitlement changes early.
- Added PayPal consent-driven subscription revisions with approval redirects, verified webhook preparation, and renewal-boundary local activation.
- Replaced PayPal webhook header comparison with PayPal's server-to-server signature verification flow and explicit webhook IDs.
- Added Paystack recurring checkout, individual cancellation/reactivation, and subscription/invoice lifecycle reconciliation while retaining the shared-plan change safety block.
- Removed the billing-domain PayPal adapter's dependency on global legacy credentials; all PayPal checkout, lifecycle, capture, refund, and verification calls now use the selected workspace connection.
- Added real PayPal capture refunds and capture-ID webhook correlation for reliable full and partial refund reconciliation.
- Added end-to-end threshold-settlement coverage proving provider checkout idempotency, signed Paystack webhook aggregation, replay safety, and duplicate-collection rejection.
September 2026Documentation and dashboard rebuild
In progress
- Added the standalone Usagey documentation portal and migrated dashboard guides into structured concept, API, and operations sections.
- Expanded settlement-aware revenue reporting with provider reconciliation and currency-safe totals.
- Standardized invoice and receipt metadata across dashboard and customer-portal billing documents.
- Consolidated dashboard navigation into Catalog, Customers, Revenue, Developer, and Settings workspaces.
- Hardened provider-managed subscription cancellation, reconciliation, and retry behavior.
Billing platform V1Foundation milestone
Foundation complete
- Introduced organization- and environment-scoped billing workspaces for Sandbox and Production.
- Added plans, features, entitlements, customers, subscriptions, credits, transactions, and developer events.
- Added
/api/usage/checkand/api/usage/trackwith API-key authentication and idempotent write handling. - Added PayPal provider lifecycle support and provider abstractions for additional adapters.
- Added customer self-service subscription, credit purchase, invoice, and receipt flows.
Release notes policy
Items marked In progress describe the current development branch. Production releases will receive a version and release date when deployed.