Billing

The Billing page shows your organization's plan, how much of each plan limit you use, and lets an owner buy or manage a subscription. Payments are handled by Creem, K-Block's billing provider: you pay on Creem's checkout page and manage the subscription in Creem's customer portal.

K-Block bills by the protected action: one decision the Gateway records for an agent's tool call. Plans differ in how many protected actions they allow per month and how many members, keys, webhooks and configuration objects an organization can hold.

Who can do what

Every member can open Billing and read the plan and usage. Only owners, signed in, can start a checkout or open Creem's customer portal; other roles see "Only owners can change the plan." on the Plan card, unless the card says that billing is not configured. A management API key with the read scope can read the billing status, but never change it.

Plans and limits

An organization without a verified paid subscription is on the free Developer plan. These are the limits of each plan (unlimited means no limit):

Prices are not part of K-Block's plans: they are set in Creem, K-Block's payment provider, where you pay. The Plan card shows owners a Choose button only for the paid plans that can be bought in the dashboard.

Developer is a solo plan

Developer is for one user. Team membership starts with Startup. Developer has room for one member, the owner who created the organization: inviting someone is refused with PLAN_LIMIT_EXCEEDED, and so is accepting an invitation to a Developer organization. To work with other people, move the organization to Startup or a larger plan.

As the only member, the owner also decides the calls a policy holds for approval. That works when the policy's approval rule admits the owner role (or the owner's user ID), as the templates' rules do; a rule that admits only the approver role finds nobody to ask, and the call is denied with NO_APPROVERS. See Who may approve.

The Plan card

The Plan card shows:

• Current plan: the plan the Cloud API reports for your organization.
• Subscription: when the organization has a subscription, its status as Creem last reported it, in words (see Subscription statuses).
• Current period ends and Cancels at period end, when a subscription has them.
• Data retention: the plan's retention period. Call arguments, error details and tool results of finished actions, delivered webhook events, and the hosted signed evidence and receipt bundles are removed after it; a minimal record of each action and the audit log are kept, and a receipt you downloaded stays verifiable. See Data retention.

Owners also see Choose buttons for the plans they can buy and, once the organization has completed a checkout, Manage subscription. If no plan can be bought and the organization has never completed a checkout, owners see a note that begins "No paid plan is available for purchase" instead. When billing is not available in the dashboard at all (neither checkout nor the customer portal), every member sees Billing is not configured in this environment on the card instead (see When billing is not configured).

Usage and limits

The Usage and limits card covers the current calendar month in UTC (the dates are shown under the title). It has a meter for each of:

• Protected actions this month
• Members
• API keys
• Webhook endpoints
• Agents
• MCP servers
• Tools
• Policies

Each meter shows what is used, the limit and what remains, or "Limit reached". On Developer, the Members meter with its one member says "Solo plan: one user" instead. A resource the Cloud API does not report shows "not reported", never zero. Below the meters, Counted this period shows the month's Policy decisions, Approvals and Receipts.

What counts as a protected action

Every new decision the Gateway records for a tool call counts once, whether it was allowed, denied or sent for approval, and whether the call came with a live or a test key. A call that the Gateway answers from an earlier decision does not count again: a repeated idempotency key, or the identical call while its action is still open (for example waiting for approval). Calls refused before any decision, such as calls over the monthly limit, are not counted.

The count covers one calendar month in UTC: it starts again at 00:00 UTC on the first day of each month.

What happens at a limit

Reaching a limit never deletes or disables anything. It only refuses new things:

• Protected actions: once the month's limit is reached, the Gateway refuses new tool calls with PLAN_LIMIT_EXCEEDED. Nothing is recorded or executed for a refused call. The count starts again at the start of the next calendar month (UTC).
• Members, API keys, webhooks, agents, MCP servers, tools, policies: creating one more fails with PLAN_LIMIT_EXCEEDED (HTTP 402). For members, open invitations count too, and the limit is checked again when someone accepts an invitation.

To get room, remove what you no longer need (revoke unused API keys, revoke open invitations) or move to a larger plan.

Over a smaller plan's limits

When an organization moves to a smaller plan, for example back to Developer when its subscription ends, K-Block keeps everything the organization already has: members keep their access, and API keys, webhook endpoints, agents, MCP servers, tools and policies stay as they are. Only new ones are refused while the organization is at or over the smaller plan's limit. The protected actions already recorded this month count against the new monthly limit, so the Gateway can refuse new calls until the next month starts.

Buy a plan

This needs the owner role and a signed-in session, and the Plan card must offer the plan with a Choose button.

1. Choose a plan

   On Billing, select Choose and the plan's name, for example Choose Startup.

2. Pay on Creem's checkout page

   The dashboard sends you to Creem's checkout page. Complete the payment there. If you leave the page without paying, nothing changes.

   For the checkout, K-Block gives Creem the plan, your organization's ID and, until your organization has completed a checkout, your account's e-mail address.

3. Wait for the confirmation

   After the payment, Creem sends you back to Billing. Coming back does not change the plan by itself: the plan changes only when K-Block has received and verified Creem's confirmation of the subscription. Until then the page says that it is waiting for the confirmation and checks again every 5 seconds, up to 24 times. Select Check again to read it once more later.

   The plan does not depend on the page: if you close it, the plan still changes when Creem's confirmation arrives. If the plan has still not changed after some minutes, contact K-Block support and tell them when you paid.

If you select Choose for the same plan again within 30 minutes, for example in a second tab, the dashboard opens the same Creem checkout instead of starting another one. While that checkout is still being created, another request is refused with CHECKOUT_IN_PROGRESS; try again in a moment. Choosing a different plan starts a new checkout. Pay on one checkout page only: if you pay twice, the organization has two subscriptions and both are charged, so contact K-Block support about the one you do not need.

Subscription statuses

The plan follows the status of the organization's subscription, as Creem reports it:

A canceled subscription never grants a plan again; to subscribe again, an owner chooses a plan on Billing. Refunds and payment disputes do not change the plan by themselves: only the subscription's status does.

Manage or cancel a subscription

Select Manage subscription to open Creem's customer portal for your organization's subscription. Any owner of the organization can open it, whoever paid. K-Block asks Creem for a new portal link each time and does not keep it.

While a subscription grants a plan (active, trialing, past_due or scheduled_cancel), a new checkout is refused with SUBSCRIPTION_ACTIVE: change or cancel the plan in the portal instead. K-Block has no plan-change or cancel button of its own.

• Change to another plan: where Creem's portal offers another plan, you switch there, and Creem handles any payment for the change. The new plan applies once Creem reports the change to K-Block. If the portal does not offer the plan you need, contact K-Block support.
• Cancel: cancelling in Creem's portal ends the subscription immediately, and the organization moves to the Developer plan as soon as Creem reports it. A cancellation scheduled for the end of the period instead (status scheduled_cancel) keeps the plan until the subscription ends.
• Payment method: update it in the portal.

When a payment fails

When a renewal payment fails, the subscription becomes past_due and keeps its plan while Creem retries the payment. If a retry succeeds, nothing changes. If Creem stops retrying, the subscription becomes unpaid or is canceled, and the organization moves to the Developer plan. To avoid this, update the payment method in Creem's portal with Manage subscription.

When billing is not configured

If the Plan card says Billing is not configured in this environment, paid plans cannot be bought or managed in the dashboard: the card shows no Choose or Manage subscription buttons, and an organization without a verified subscription stays on the free Developer plan. A checkout or customer-portal request that is refused for this reason shows "Plans cannot be bought or managed here right now." instead of an error code.

The plan's limits still apply as described above. In this version a plan changes only through a Creem subscription. If your organization needs a larger plan, contact K-Block support, with the request ID shown in the error if a request was refused.

Errors

When paid plans cannot be bought or managed in the dashboard, a refused checkout or portal request shows no code: the error says "Plans cannot be bought or managed here right now." See When billing is not configured.

What is not implemented

In this version, K-Block does not:

• show prices, invoices or payment history in the dashboard (payments happen on Creem's pages);
• bill per protected action beyond the plan, or report usage to Creem: a plan is a fixed subscription with limits, and calls over the monthly limit are refused, not charged;
• delete audit events, or the minimal record of an action, after the retention period (hosted evidence and receipt bundles are deleted; see Data retention);
• offer a way to buy a plan without Creem, or to change or cancel a plan in the dashboard (that happens in Creem's customer portal).

Related pages