Billing & subscriptions
Plans are workspace-scoped (one subscription per workspace). Free is permanent; paid tiers attach a Stripe subscription that the workspace owner can manage from /plans.
Upgrades: immediate with prorated charge
Switching to a higher tier fires a prorated invoice today: the difference between what you'd have paid on the new plan for the rest of the current cycle and what you've already paid for the old plan, charged to your card on file the moment you confirm. The new monthly / annual rate kicks in from the next renewal. The new plan's caps take effect immediately.
Downgrades: take effect at end of current cycle
Switching to a lower tier schedules the change for the end of the cycle you already paid for. You keep all the higher-tier benefits until that date, then Stripe automatically rolls you onto the lower-tier price. No surprise refund, no surprise downgrade.
Over-cap on downgrade: projects pause, never delete
If the new plan allows fewer projects than you have active, EndpointOS pauses the excess oldest-first when the downgrade lands. Paused projects return 503 PROJECT_PAUSED from the public API, but every record, resource, key, log, and webhook is preserved exactly as it was. Reactivate any of them from the dashboard banner; reactivation is gated by the new plan's cap, so pick which projects matter and pause / archive others to swap.
Existing resources and API keys keep working past the new plan's caps. New resource / key creation is blocked until you're under cap. API keys are never auto-revoked on downgrade.
Members: pre-flight gate
If the picked plan can't seat your current workspace members, the downgrade is refused at the button with a clear message ("Starter allows 1 seat; this workspace has 4. Remove 3 members first."). Members are reversible by hand; auto-kicking them would be too surprising. Remove the excess members, then try again.
One subscription per workspace
A workspace can only have one active Stripe subscription at a time. Trying to start a new checkout while subscribed routes you to an in-place change with the prorated preview instead of opening a second parallel subscription.