Skip to main content

Changelog

Product, API, SDK, and documentation changes are grouped by release date. Expand a release to read its details.

2026-09-21Dashboard access and visual consistency
  • Made webhook integrations available on every plan with capacity-based limits: three endpoints on Free and grandfathered Launch, ten on Growth, and unlimited capacity on Enterprise.
  • Removed webhook and additional-organization paywall cards while retaining server-enforced account capacity limits.
  • Added direct API enforcement for webhook and organization creation limits so hidden dashboard actions cannot be bypassed.
  • Standardized protected dashboard cards, controls, dialogs, and sheets on square corners while preserving circular avatars and status indicators.
  • Refreshed dashboard screenshots used throughout the documentation to match the current product UI.
2026-09-20Public API and Node.js SDK
  • Added versioned public API hosts: api.usagey.com/v1 for production and sandbox.usagey.com/v1 for sandbox.
  • Added host-to-key environment enforcement for usage requests and host-scoped provider webhook reconciliation.
  • Added API-key-authenticated /v1/checkout and Node SDK checkout support for plan assignment and one-time credit-pack purchases.
  • Added API-key-authenticated /v1/events and typed SDK pagination for developer-event consumption.
  • Added published, type-checked Node SDK examples for usage, checkout, and developer-event pagination.
  • Hardened account-allowance warning delivery with atomic claims, bounded retries, and stale-worker recovery.
  • Kept the existing /api/usage/* handlers as a temporary compatibility bridge.
2026-09-20Pricing, credits, and packaging
  • Simplified public pricing to Free, Growth, and Enterprise; Launch remains supported only for existing grandfathered subscriptions.
  • Increased the Free allowance from 2K to 5K tracked events per month.
  • Added reusable Product Credits and AI Credits templates on top of the generic credit ledger.
  • Added inactive pack drafts, credit-system selection, pack editing, and an explicit publish step in Add-ons.
  • Prevented zero-price packs from being activated or exposed for new customer purchases.
  • Added organization-specific, evidence-gated account quota enforcement with audited approvals and rollbacks.
  • Added platform-admin rollout controls that remain locked until account counters reconcile with immutable meter events.
  • Added true package/block pricing with configurable units per package, cumulative delta charging, promotion support, and billing-document audit details.
  • Migrated the Node.js SDK to the current check/track APIs with typed entitlement decisions, idempotent writes, and a compatibility alias for UsageyClient.
2026-09-19Proration and seat changes
  • Finalized upgrade, downgrade, and seat-change policy; versioned proration previews now show the unused current-plan credit and remaining target-plan charge.
  • Added idempotent, pending tax-aware proration transactions for immediate internally managed upgrades and seat increases.
2026-09-14Security and recurring lifecycle
  • Added a state-aware recurring provider capability contract across subscription APIs, dashboard management, and the customer portal.
  • Added customer self-serve reactivation for supported Stripe and Paystack scheduled cancellations, while pre-announcing unsupported PayPal reactivation and Paystack plan or seat changes.
  • Locked V2 tax behavior to manual configuration, added deterministic inclusive/exclusive quotes for manual transaction imports, and preserved immutable tax provenance in invoices and receipts.
  • Added an admin-only account-usage reconciliation report that compares shadow counters with immutable consuming meter events and blocks rollout readiness on mismatches, orphan events, overlapping periods, or truncated results.
  • Replaced the platform-admin organization's placeholder Usage tab with a read-only quota reconciliation workflow and period-level mismatch evidence.
  • Aligned rejected consuming requests with each organization's active subscription period instead of falling back to calendar months.
  • Added a visual, searchable OpenAPI reference with endpoint groups, schemas, examples, and JSON download support.
  • Extended distributed rate limiting to authentication, password recovery, bot verification, checkout confirmation, and billing API-key creation and rotation.
  • Standardized protected-route failures with explicit 429 or fail-closed production 503 responses and rate-limit retry headers.
  • Added an audited two-phase billing API-key migration workflow with readiness reporting, hash verification, and fail-closed plaintext finalization.
  • Changed public API authentication to prefer hashed lookup and self-migrate a legacy key after a successful compatibility lookup.
  • Added provider-credential key-ring rotation, stale-envelope readiness reporting, and migration that removes sensitive fields left in public provider configuration.
  • Added tenant-scoped billing API-key expiry, revocation, reactivation, and atomic rotation APIs with one-time replacement-secret reveal.
  • Replaced the dashboard's legacy API-key screen with a workspace-aware Developer workflow using opaque create/manage sheets, and removed the duplicate key panel from Provider Settings.
  • Added forced PostgreSQL RLS policies for Usagey's organization-level commercial control plane without merging it into customer billing-workspace policy.
  • Restricted account counters, volume allowances, notifications, economics snapshots, and Enterprise onboarding to the selected organization or explicit audited control-plane work.
  • Restricted global infrastructure cost inputs to audited platform-admin transactions with no selected tenant.
  • Added organization/workspace consistency checks for immutable platform meter events.
  • Moved economics, allowance, Enterprise, and notification operations off unrestricted Prisma access while keeping email delivery outside database transactions.
  • Extended CI's non-superuser database proof across commercial organization isolation and global cost visibility.
2026-09-13Tenant isolation and billing operations
  • Bound authenticated subscription creation, previews, cancellation, reactivation, and plan changes to operator-scoped tenant transactions.
  • Added customer-scoped tenant context for self-serve subscription previews, plan changes, and cancellation.
  • Made subscription state, developer events, and idempotency responses commit atomically for local lifecycle operations.
  • Added workspace ownership checks for customer, plan, and provider references during subscription creation.
  • Replaced fixed-date proration coverage with rolling active-period fixtures so lifecycle tests remain valid over time.
  • Migrated authenticated transaction lists, details, receipt generation, manual imports, refunds, and refund retries to operator-scoped tenant transactions.
  • Made refund eligibility checks, reconciliation effects, retry linkage, developer events, and idempotency responses atomic for local refund workflows.
  • Added a semantic Transactions page heading and retained end-to-end coverage for the complete admin receipt, refund, and retry workflow.
  • Bound customer-portal summaries, usage, balances, transactions, invoices, receipts, and subscription ownership checks to customer-scoped tenant transactions.
  • Added database-level customer filtering for portal invoice aggregation and excluded uncorrelated shared-provider webhook activity from customer views.
  • Bound operator and customer-portal checkout creation and confirmation to tenant-scoped idempotency transactions.
  • Added customer ownership checks before provider checkout confirmation and replay-safe one-time credit settlement coverage.
  • Migrated provider connection management and Provider Settings rendering to operator-scoped tenant transactions.
  • Added secret-preserving provider updates so blank credential fields do not erase the existing encrypted checkout or webhook configuration.
  • Moved verified PayPal, Stripe, and Paystack webhook persistence and reconciliation into audited workspace-scoped SYSTEM transactions.
  • Made webhook state changes, refunds, settlements, and developer-event records atomic while preserving failed webhook audits before returning errors.
  • Migrated developer-event history, webhook diagnostics, and dashboard event summaries to operator-scoped tenant queries.
  • Added cursor pagination plus event-type, status, and text filters to developer-event history while keeping SSE transactions short-lived.
  • Migrated dashboard overview, catalog, customer, subscription, transaction, usage, revenue, analytics, settings, and onboarding reads to operator-scoped tenant transactions.
  • Bound analytics and operational exports to the selected workspace transaction instead of unrestricted reporting queries.
  • Split invoice email delivery into tenant-scoped lookup and audit-write phases so provider email latency never holds a database transaction open.
  • Removed readable billing API keys from the Usage dashboard; only secure key fingerprints or a legacy rotation prompt are displayed.
  • Bound provider settlement collection and refund allocation to the operator-scoped idempotency transaction, including reconciliation and developer-event writes.
  • Added audited SYSTEM tenant context for internal subscription renewals, invoice issuance, threshold settlement, and compliance-retention cron work.
  • Kept invoice email-provider calls outside database transactions while retaining tenant-scoped lookup and issuance audit phases.
  • Restricted provider-managed renewal discovery to workspace identifiers, then moved subscription loading, optimistic claims, local activation, failures, and developer events into audited per-workspace SYSTEM transactions.
  • Kept Stripe and PayPal renewal API calls outside database transactions while preserving stale-claim recovery.
  • Bound customer data exports, deletion audits, customer deletion, and billing-action previews to authenticated operator transactions.
  • Added audited system-discovery transactions for cron candidate enumeration, operator workspace resolution, portal identity resolution, and explicit workspace provisioning.
  • Tightened the staged PostgreSQL tenant predicate so workspace-scoped SYSTEM jobs cannot access another workspace; cross-workspace discovery is allowed only when no workspace is selected and an audit reason is present.
  • Moved legacy catalog backfill into a workspace-scoped system transaction and made environment promotion one atomic, idempotent cross-workspace operation.
  • Stopped copying provider connections during Sandbox-to-Production promotion; Production payment credentials must be configured independently.
  • Bound workspace overview/settings and rejected-request platform metering to their authenticated tenant transactions.
  • Removed unscoped transaction fallbacks from invoice actions, threshold settlement, compliance cleanup, and internal subscription renewals; callers must now supply a tenant context or tenant-bound database client.
  • Routed economics snapshots, provider-credential migration, and provider webhook candidate lookup through named audited system-discovery transactions.
  • Made billing analytics, reporting, invoice lookup, exports, and provider settlement collection require an injected tenant-bound database client.
  • Removed unrestricted checkout, developer-event, and reconciliation fallbacks; provider settlement confirmation now performs tenant-scoped read and write phases around the external provider call.
  • Added forced PostgreSQL row-level security policies for the V2 billing workspace tables, including relation-backed plan, credit, entitlement, and settlement records.
  • Moved public API-key resolution into audited system discovery and key telemetry into the resolved API-key tenant context.
  • Changed CI database setup from schema push to migration deployment so PostgreSQL functions and row-level security policies are installed before tests run.
  • Added live tenant-isolation tests through a temporary non-superuser PostgreSQL role, covering operator reads, direct and relation-backed cross-workspace writes, scoped system jobs, and explicit audited discovery.
2026-09-12Tenant context foundation
  • Added transaction-local organization, workspace, environment, and actor context to public entitlement and usage writes.
  • Bound usage idempotency records to the same authenticated workspace context and rejected mismatched tenant records before database work begins.
  • Migrated authenticated catalog reads and writes, plan-entitlement tiers, and default-plan seeding to operator-bound tenant transactions.
  • Migrated customer management and manual entitlement overrides to the same operator-bound transaction boundary.
  • Added PostgreSQL tenant-policy helper functions while keeping table-level RLS activation staged until all access paths are migrated.
2026-09-11Refunds, portals, and workspace provisioning
  • Added multi-capture provider refunds for credit-direction usage settlements, with durable allocation records, pending webhook reconciliation, and duplicate-dispatch protection.
  • Changed completed credit settlement aggregates to zero-value audit markers because their refund transactions already represent the cash movement.
  • Added dashboard refund-allocation progress and end-to-end Paystack proof for multi-capture credit settlement reconciliation.
  • Added effective limit, remaining allowance, reset timing, manual override, and overage-policy visibility to the customer portal.
  • Removed production workspace seeding from customer-portal reads; unconfigured portals now return a read-only not-configured response.
  • Removed implicit workspace creation from all billing management reads; only authenticated mutation and setup flows can provision an environment workspace.
  • Removed plaintext default-key generation from workspace backfill and sanitized API-key metadata returned by workspace overview responses.
  • Moved dashboard workspace provisioning out of page rendering and into signup, organization creation, and an explicit environment setup action.
2026-09-10Commercial hardening
  • Standardized Usagey account allowances at 2K for Free, 250K for Launch, and 2M for Growth accepted units per month.
  • Added idempotent account-level usage metering, shadow-mode enforcement, and warning notifications at 80%, 90%, and 100% usage.
  • Added explicit additional-volume grants without publishing or applying an unvalidated overage rate.
  • Added fully loaded economics snapshots that separate fixed, variable, and directly attributable infrastructure costs from marginal cost.
  • Added one-time API-key reveal with hashed authentication and encrypted payment-provider credential storage.
  • Added immediate Stripe plan and seat upgrades with invoiced proration and explicit provider price mappings; unsafe provider-managed scheduled changes remain blocked.
  • Added rolling paid-account economics with separate Free-tier capacity reporting and fully-loaded margin guidance.
  • Added consecutive-period hard-limit signals for internal upgrade and Enterprise qualification workflows.
  • Added two-phase Stripe renewal synchronization for scheduled plan downgrades and seat decreases without granting local entitlement changes early.
  • Added PayPal consent-driven subscription revisions with approval redirects, verified webhook preparation, and renewal-boundary local activation.
  • Replaced PayPal webhook header comparison with PayPal's server-to-server signature verification flow and explicit webhook IDs.
  • Added Paystack recurring checkout, individual cancellation/reactivation, and subscription/invoice lifecycle reconciliation while retaining the shared-plan change safety block.
  • Removed the billing-domain PayPal adapter's dependency on global legacy credentials; all PayPal checkout, lifecycle, capture, refund, and verification calls now use the selected workspace connection.
  • Added real PayPal capture refunds and capture-ID webhook correlation for reliable full and partial refund reconciliation.
  • Added end-to-end threshold-settlement coverage proving provider checkout idempotency, signed Paystack webhook aggregation, replay safety, and duplicate-collection rejection.
September 2026Documentation and dashboard rebuild

In progress

  • Added the standalone Usagey documentation portal and migrated dashboard guides into structured concept, API, and operations sections.
  • Expanded settlement-aware revenue reporting with provider reconciliation and currency-safe totals.
  • Standardized invoice and receipt metadata across dashboard and customer-portal billing documents.
  • Consolidated dashboard navigation into Catalog, Customers, Revenue, Developer, and Settings workspaces.
  • Hardened provider-managed subscription cancellation, reconciliation, and retry behavior.
Billing platform V1Foundation milestone

Foundation complete

  • Introduced organization- and environment-scoped billing workspaces for Sandbox and Production.
  • Added plans, features, entitlements, customers, subscriptions, credits, transactions, and developer events.
  • Added /api/usage/check and /api/usage/track with API-key authentication and idempotent write handling.
  • Added PayPal provider lifecycle support and provider abstractions for additional adapters.
  • Added customer self-service subscription, credit purchase, invoice, and receipt flows.
Release notes policy

Items marked In progress describe the current development branch. Production releases will receive a version and release date when deployed.