Keys, quotas and billing

What a key grants, what it consumes, and what happens when it runs out.

API keys

One active key per account at this stage.
The key is shown in clear only at creation: we never store it in clear, so it can never be shown again.
Regenerating a key revokes the previous one immediately. Plan to update your CI secrets right after.

The key goes through your secret store, never the repository

Never commit a key, not even to a private repository. Put it in your CI's secret store and read it from the CABFY_API_KEY environment variable — the command line picks it up automatically.

What authentication changes

	Without a key	With a key
Rate allowed	5 requests/hour per IP address	60 requests/hour per account
Discoverability and catalog quality	Available	Available
Agent simulation	Always disabled	Subject to your monthly quota
Account attribution, history, badges	No	Yes

Rate limiting protects processing capacity; it's independent of the quota, which governs cost. The two rarely meet.

Simulation quota

Only the agent simulation consumes quota — it's the one check that calls a language model, and therefore the one that costs money to run. The other two are unlimited, within the rate limit.

Plan	Simulations per month	Cycle
Free	0	—
Growth (€29/month)	150	Aligned with your subscription, not the calendar month

The cycle follows your subscription, not the calendar

The cycle follows your subscription's real dates. A subscription started on the 12th renews on the 12th, not on the 1st — don't write calendar-month reset logic client-side.

When the quota runs out

The request is refused with a 402 and the quota_exceeded code, and no audit is created. The body carries quota_used and quota_limit.

No silent degradation: the request does not fall back to an audit without simulation that would return a lower score without saying so. A pipeline using the score as a blocking gate must know the simulation didn't run, not receive a truncated result it believes is complete.

Billing

Everything goes through the Stripe billing portal, reachable from the dashboard — there's no in-house billing screen to integrate against.
On a failed payment, the Growth quota is kept during Stripe's automatic retries, and Stripe sends its own reminders.
The quota only drops back to Free once the subscription is actually cancelled.