Billing & Plans

OrcFlows has a built-in plan ladder enforced at the application layer, with optional Stripe integration for self-serve upgrades.

Plans

	Free	Pro	Enterprise
Price	$0	$49/mo	$299/mo
Active workflows	10	Unlimited	Unlimited
Seats	3	20	Unlimited
Worker quota (concurrent executions)	2	10	50
CPU limit (sandbox)	1.0	2.0	8.0
Memory limit (sandbox)	256 MB	512 MB	2048 MB
SSO	✗	✗	✓
Organizations	✗	✗	✓

This table is the single source of truth (internal/billing/plans.go) — used both to enforce limits server-side (e.g. blocking workflow creation past max_active_workflows) and to render the pricing page (GET /api/v1/billing/plans). A 0 value for any max_* field means unlimited.

Endpoints

Endpoint	Role required	Description
GET /api/v1/billing/plans	any member	Returns the plan ladder (PlanLimits) for the pricing UI.
GET /api/v1/billing/subscription	any member	Current tenant's plan, status, renewal date.
POST /api/v1/billing/checkout	owner	Creates a Stripe Checkout session for upgrading to Pro/Enterprise.
POST /api/v1/billing/portal	owner	Creates a Stripe Customer Portal session (manage payment method, cancel, view invoices).

Stripe setup

Set these to enable billing (see Configuration):

• STRIPE_SECRET_KEY — without this, Stripe is disabled and all tenants stay on Free (upgrade buttons are hidden/disabled).
• STRIPE_WEBHOOK_SECRET — verifies signatures on POST /webhooks/stripe.
• STRIPE_PRICE_ID_PRO / STRIPE_PRICE_ID_ENTERPRISE — Stripe Price IDs mapped to tenant.PlanPro / tenant.PlanEnterprise.
• STRIPE_SUCCESS_URL / STRIPE_CANCEL_URL / STRIPE_PORTAL_RETURN_URL — frontend redirect targets after checkout/portal.

Webhook → subscription sync

POST /webhooks/stripe (public, signature-verified, raw body) handles Stripe subscription lifecycle events and calls UpsertFromStripe(tenantID, customerID, subscriptionID, plan, status, currentPeriodEnd, cancelAtPeriodEnd) to keep the tenant's subscriptions row in sync — this is what ultimately changes tenant.plan and therefore which PlanLimits apply.

Plan enforcement

Plan limits are checked at the point of action, not just displayed:

• Creating a workflow checks MaxActiveWorkflows against the tenant's current count (Free: 10, Pro/Enterprise: unlimited).
• Inviting a team member checks MaxSeats.
• The Temporal worker's concurrency and the sandbox's CPU/memory limits are derived from WorkerQuota, CPULimit, and MemLimitMB.
• SSO config (/api/v1/sso/config) and organization creation (/api/v1/organizations) are rejected unless SSOEnabled / OrganizationsEnabled is true for the tenant's plan.

Next

• Teams, Organizations & Roles
• Architecture: Multi-tenancy