improvement(api-keys): move to workspace level

apps/docs/content/docs/de/sdks/python.mdx

@@ -284,7 +284,6 @@ class AsyncExecutionResult:
 class WorkflowStatus:
     is_deployed: bool
     deployed_at: Optional[str] = None
-    is_published: bool = False
     needs_redeployment: bool = False
 ```
 

apps/docs/content/docs/de/sdks/typescript.mdx

@@ -301,7 +301,6 @@ interface AsyncExecutionResult {
 interface WorkflowStatus {
   isDeployed: boolean;
   deployedAt?: string;
-  isPublished: boolean;
   needsRedeployment: boolean;
 }
 ```

apps/docs/content/docs/en/sdks/python.mdx

@@ -283,7 +283,6 @@ class AsyncExecutionResult:
 class WorkflowStatus:
     is_deployed: bool
     deployed_at: Optional[str] = None
-    is_published: bool = False
     needs_redeployment: bool = False
 ```
 

apps/docs/content/docs/en/sdks/typescript.mdx

@@ -294,7 +294,6 @@ interface AsyncExecutionResult {
 interface WorkflowStatus {
   isDeployed: boolean;
   deployedAt?: string;
-  isPublished: boolean;
   needsRedeployment: boolean;
 }
 ```

apps/docs/content/docs/es/sdks/python.mdx

@@ -284,7 +284,6 @@ class AsyncExecutionResult:
 class WorkflowStatus:
     is_deployed: bool
     deployed_at: Optional[str] = None
-    is_published: bool = False
     needs_redeployment: bool = False
 ```
 

apps/docs/content/docs/es/sdks/typescript.mdx

@@ -301,7 +301,6 @@ interface AsyncExecutionResult {
 interface WorkflowStatus {
   isDeployed: boolean;
   deployedAt?: string;
-  isPublished: boolean;
   needsRedeployment: boolean;
 }
 ```

apps/docs/content/docs/fr/sdks/python.mdx

@@ -284,7 +284,6 @@ class AsyncExecutionResult:
 class WorkflowStatus:
     is_deployed: bool
     deployed_at: Optional[str] = None
-    is_published: bool = False
     needs_redeployment: bool = False
 ```
 

apps/docs/content/docs/fr/sdks/typescript.mdx

@@ -301,7 +301,6 @@ interface AsyncExecutionResult {
 interface WorkflowStatus {
   isDeployed: boolean;
   deployedAt?: string;
-  isPublished: boolean;
   needsRedeployment: boolean;
 }
 ```

apps/docs/content/docs/ja/sdks/python.mdx

@@ -284,7 +284,6 @@ class AsyncExecutionResult:
 class WorkflowStatus:
     is_deployed: bool
     deployed_at: Optional[str] = None
-    is_published: bool = False
     needs_redeployment: bool = False
 ```
 

apps/docs/content/docs/ja/sdks/typescript.mdx

@@ -301,7 +301,6 @@ interface AsyncExecutionResult {
 interface WorkflowStatus {
   isDeployed: boolean;
   deployedAt?: string;
-  isPublished: boolean;
   needsRedeployment: boolean;
 }
 ```

apps/docs/content/docs/zh/sdks/python.mdx

@@ -284,7 +284,6 @@ class AsyncExecutionResult:
 class WorkflowStatus:
     is_deployed: bool
     deployed_at: Optional[str] = None
-    is_published: bool = False
     needs_redeployment: bool = False
 ```
 

apps/docs/content/docs/zh/sdks/typescript.mdx

@@ -301,7 +301,6 @@ interface AsyncExecutionResult {
 interface WorkflowStatus {
   isDeployed: boolean;
   deployedAt?: string;
-  isPublished: boolean;
   needsRedeployment: boolean;
 }
 ```

apps/sim/app/api/billing/portal/route.ts

@@ -1,6 +1,6 @@
 import { db } from '@sim/db'
 import { subscription as subscriptionTable, user } from '@sim/db/schema'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, or } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getSession } from '@/lib/auth'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
@@ -38,7 +38,10 @@ export async function POST(request: NextRequest) {
         .where(
           and(
             eq(subscriptionTable.referenceId, organizationId),
-            eq(subscriptionTable.status, 'active')
+            or(
+              eq(subscriptionTable.status, 'active'),
+              eq(subscriptionTable.cancelAtPeriodEnd, true)
+            )
           )
         )
         .limit(1)

apps/sim/app/api/webhooks/trigger/[path]/route.test.ts

@@ -109,17 +109,17 @@ describe('Webhook Trigger API Route', () => {
     globalMockData.workflows.push({
       id: 'test-workflow-id',
       userId: 'test-user-id',
-      pinnedApiKeyId: 'test-pinned-api-key-id',
+      workspaceId: 'test-workspace-id',
     })
 
-    vi.doMock('@/lib/api-key/service', async () => {
-      const actual = await vi.importActual('@/lib/api-key/service')
+    vi.doMock('@/lib/workspaces/utils', async () => {
+      const actual = await vi.importActual('@/lib/workspaces/utils')
       return {
         ...(actual as Record<string, unknown>),
-        getApiKeyOwnerUserId: vi
+        getWorkspaceBilledAccountUserId: vi
           .fn()
-          .mockImplementation(async (pinnedApiKeyId: string | null | undefined) =>
-            pinnedApiKeyId ? 'test-user-id' : null
+          .mockImplementation(async (workspaceId: string | null | undefined) =>
+            workspaceId ? 'test-user-id' : null
           ),
       }
     })
@@ -240,7 +240,7 @@ describe('Webhook Trigger API Route', () => {
       globalMockData.workflows.push({
         id: 'test-workflow-id',
         userId: 'test-user-id',
-        pinnedApiKeyId: 'test-pinned-api-key-id',
+        workspaceId: 'test-workspace-id',
       })
 
       const req = createMockRequest('POST', { event: 'test', id: 'test-123' })
@@ -272,7 +272,7 @@ describe('Webhook Trigger API Route', () => {
       globalMockData.workflows.push({
         id: 'test-workflow-id',
         userId: 'test-user-id',
-        pinnedApiKeyId: 'test-pinned-api-key-id',
+        workspaceId: 'test-workspace-id',
       })
 
       const headers = {
@@ -307,7 +307,7 @@ describe('Webhook Trigger API Route', () => {
       globalMockData.workflows.push({
         id: 'test-workflow-id',
         userId: 'test-user-id',
-        pinnedApiKeyId: 'test-pinned-api-key-id',
+        workspaceId: 'test-workspace-id',
       })
 
       const headers = {
@@ -338,7 +338,7 @@ describe('Webhook Trigger API Route', () => {
       globalMockData.workflows.push({
         id: 'test-workflow-id',
         userId: 'test-user-id',
-        pinnedApiKeyId: 'test-pinned-api-key-id',
+        workspaceId: 'test-workspace-id',
       })
 
       vi.doMock('@trigger.dev/sdk', () => ({
@@ -388,7 +388,7 @@ describe('Webhook Trigger API Route', () => {
       globalMockData.workflows.push({
         id: 'test-workflow-id',
         userId: 'test-user-id',
-        pinnedApiKeyId: 'test-pinned-api-key-id',
+        workspaceId: 'test-workspace-id',
       })
 
       vi.doMock('@trigger.dev/sdk', () => ({

apps/sim/app/api/workflows/[id]/deploy/route.ts

@@ -1,6 +1,6 @@
-import { apiKey, db, workflow, workflowDeploymentVersion } from '@sim/db'
+import { db, workflow, workflowDeploymentVersion } from '@sim/db'
 import { and, desc, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
+import type { NextRequest } from 'next/server'
 import { createLogger } from '@/lib/logs/console/logger'
 import { generateRequestId } from '@/lib/utils'
 import { deployWorkflow } from '@/lib/workflows/db-helpers'
@@ -38,35 +38,6 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
       })
     }
 
-    let keyInfo: { name: string; type: 'personal' | 'workspace' } | null = null
-
-    if (workflowData.pinnedApiKeyId) {
-      const pinnedKey = await db
-        .select({ key: apiKey.key, name: apiKey.name, type: apiKey.type })
-        .from(apiKey)
-        .where(eq(apiKey.id, workflowData.pinnedApiKeyId))
-        .limit(1)
-
-      if (pinnedKey.length > 0) {
-        keyInfo = { name: pinnedKey[0].name, type: pinnedKey[0].type as 'personal' | 'workspace' }
-      }
-    } else {
-      const userApiKey = await db
-        .select({
-          key: apiKey.key,
-          name: apiKey.name,
-          type: apiKey.type,
-        })
-        .from(apiKey)
-        .where(and(eq(apiKey.userId, workflowData.userId), eq(apiKey.type, 'personal')))
-        .orderBy(desc(apiKey.lastUsed), desc(apiKey.createdAt))
-        .limit(1)
-
-      if (userApiKey.length > 0) {
-        keyInfo = { name: userApiKey[0].name, type: userApiKey[0].type as 'personal' | 'workspace' }
-      }
-    }
-
     let needsRedeployment = false
     const [active] = await db
       .select({ state: workflowDeploymentVersion.state })
@@ -97,7 +68,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
 
     logger.info(`[${requestId}] Successfully retrieved deployment info: ${id}`)
 
-    const responseApiKeyInfo = keyInfo ? `${keyInfo.name} (${keyInfo.type})` : 'No API key found'
+    const responseApiKeyInfo = workflowData.workspaceId ? 'Workspace API keys' : 'Personal API keys'
 
     return createSuccessResponse({
       apiKey: responseApiKeyInfo,
@@ -127,101 +98,6 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
       return createErrorResponse(error.message, error.status)
     }
 
-    const userId = workflowData!.userId
-
-    let providedApiKey: string | null = null
-    try {
-      const parsed = await request.json()
-      if (parsed && typeof parsed.apiKey === 'string' && parsed.apiKey.trim().length > 0) {
-        providedApiKey = parsed.apiKey.trim()
-      }
-    } catch (_err) {}
-
-    logger.debug(`[${requestId}] Validating API key for deployment`)
-
-    let keyInfo: { name: string; type: 'personal' | 'workspace' } | null = null
-    let matchedKey: {
-      id: string
-      key: string
-      name: string
-      type: 'personal' | 'workspace'
-    } | null = null
-
-    // Use provided API key, or fall back to existing pinned API key for redeployment
-    const apiKeyToUse = providedApiKey || workflowData!.pinnedApiKeyId
-
-    if (!apiKeyToUse) {
-      return NextResponse.json(
-        { error: 'API key is required. Please create or select an API key before deploying.' },
-        { status: 400 }
-      )
-    }
-
-    let isValidKey = false
-
-    const currentUserId = session?.user?.id
-
-    if (currentUserId) {
-      const [personalKey] = await db
-        .select({
-          id: apiKey.id,
-          key: apiKey.key,
-          name: apiKey.name,
-          expiresAt: apiKey.expiresAt,
-        })
-        .from(apiKey)
-        .where(
-          and(
-            eq(apiKey.id, apiKeyToUse),
-            eq(apiKey.userId, currentUserId),
-            eq(apiKey.type, 'personal')
-          )
-        )
-        .limit(1)
-
-      if (personalKey) {
-        if (!personalKey.expiresAt || personalKey.expiresAt >= new Date()) {
-          matchedKey = { ...personalKey, type: 'personal' }
-          isValidKey = true
-          keyInfo = { name: personalKey.name, type: 'personal' }
-        }
-      }
-    }
-
-    if (!isValidKey) {
-      if (workflowData!.workspaceId) {
-        const [workspaceKey] = await db
-          .select({
-            id: apiKey.id,
-            key: apiKey.key,
-            name: apiKey.name,
-            expiresAt: apiKey.expiresAt,
-          })
-          .from(apiKey)
-          .where(
-            and(
-              eq(apiKey.id, apiKeyToUse),
-              eq(apiKey.workspaceId, workflowData!.workspaceId),
-              eq(apiKey.type, 'workspace')
-            )
-          )
-          .limit(1)
-
-        if (workspaceKey) {
-          if (!workspaceKey.expiresAt || workspaceKey.expiresAt >= new Date()) {
-            matchedKey = { ...workspaceKey, type: 'workspace' }
-            isValidKey = true
-            keyInfo = { name: workspaceKey.name, type: 'workspace' }
-          }
-        }
-      }
-    }
-
-    if (!isValidKey) {
-      logger.warn(`[${requestId}] Invalid API key ID provided for workflow deployment: ${id}`)
-      return createErrorResponse('Invalid API key provided', 400)
-    }
-
     // Attribution: this route is UI-only; require session user as actor
     const actorUserId: string | null = session?.user?.id ?? null
     if (!actorUserId) {
@@ -232,8 +108,6 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
     const deployResult = await deployWorkflow({
       workflowId: id,
       deployedBy: actorUserId,
-      pinnedApiKeyId: matchedKey?.id,
-      includeDeployedState: true,
       workflowName: workflowData!.name,
     })
 
@@ -243,20 +117,11 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
 
     const deployedAt = deployResult.deployedAt!
 
-    if (matchedKey) {
-      try {
-        await db
-          .update(apiKey)
-          .set({ lastUsed: new Date(), updatedAt: new Date() })
-          .where(eq(apiKey.id, matchedKey.id))
-      } catch (e) {
-        logger.warn(`[${requestId}] Failed to update lastUsed for api key`)
-      }
-    }
-
     logger.info(`[${requestId}] Workflow deployed successfully: ${id}`)
 
-    const responseApiKeyInfo = keyInfo ? `${keyInfo.name} (${keyInfo.type})` : 'Default key'
+    const responseApiKeyInfo = workflowData!.workspaceId
+      ? 'Workspace API keys'
+      : 'Personal API keys'
 
     return createSuccessResponse({
       apiKey: responseApiKeyInfo,
@@ -298,7 +163,7 @@ export async function DELETE(
 
       await tx
         .update(workflow)
-        .set({ isDeployed: false, deployedAt: null, deployedState: null, pinnedApiKeyId: null })
+        .set({ isDeployed: false, deployedAt: null })
         .where(eq(workflow.id, id))
     })