feat(api): send apiKeyId in Autumn check properties for per-key usage limits (firecrawl#3977)

Co-authored-by: firecrawl-spring[bot] <254786068+firecrawl-spring[bot]@users.noreply.github.com>
Co-authored-by: micahstairs <micah@sideguide.dev>
Co-authored-by: Micah Stairs <micah.stairs@gmail.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

Author: 3 people

apps/api/src/__tests__/routes/check-credits-middleware.test.ts

@@ -111,6 +111,34 @@ describe("checkCreditsMiddleware – Autumn overage handling", () => {
     expect(res.status).not.toHaveBeenCalled();
     expect(req.body.limit).toBe(5);
   });
+
+  it("forwards the API key id in the check properties so Autumn can enforce per-key limits", async () => {
+    checkCreditsMock.mockResolvedValue({ allowed: true, remaining: 100 });
+
+    const req = buildReq({
+      acuc: { adjusted_credits_used: 0, api_key_id: 4242 },
+    });
+    await runMiddleware(req);
+
+    expect(checkCreditsMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        properties: expect.objectContaining({ apiKeyId: 4242 }),
+      }),
+    );
+  });
+
+  it("sends a null apiKeyId when the request has no resolved api key id", async () => {
+    checkCreditsMock.mockResolvedValue({ allowed: true, remaining: 100 });
+
+    const req = buildReq();
+    await runMiddleware(req);
+
+    expect(checkCreditsMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        properties: expect.objectContaining({ apiKeyId: null }),
+      }),
+    );
+  });
 });
 
 describe("checkCreditsMiddleware – unverified agent-key 50-credit cap", () => {

apps/api/src/controllers/v0/crawl.ts

@@ -142,7 +142,7 @@ export async function crawlController(req: Request, res: Response) {
     const autumnResult = await autumnService.checkCredits({
       teamId: team_id,
       value: limitCheck,
-      properties: { source: "v0/crawl" },
+      properties: { source: "v0/crawl", apiKeyId: chunk?.api_key_id ?? null },
     });
 
     if (autumnResult !== null && !autumnResult.allowed) {

apps/api/src/controllers/v0/scrape.ts

@@ -269,7 +269,10 @@ export async function scrapeController(req: Request, res: Response) {
       const autumnResult = await autumnService.checkCredits({
         teamId: team_id,
         value: 1,
-        properties: { source: "v0/scrape" },
+        properties: {
+          source: "v0/scrape",
+          apiKeyId: chunk?.api_key_id ?? null,
+        },
       });
       // null = Autumn unavailable / self-hosted -> fail open, matching v1/v2.
       if (autumnResult !== null && !autumnResult.allowed) {

apps/api/src/controllers/v0/search.ts

@@ -248,7 +248,10 @@ export async function searchController(req: Request, res: Response) {
       const autumnResult = await autumnService.checkCredits({
         teamId: team_id,
         value: 1,
-        properties: { source: "v0/search" },
+        properties: {
+          source: "v0/search",
+          apiKeyId: chunk?.api_key_id ?? null,
+        },
       });
       // null = Autumn unavailable / self-hosted -> fail open, matching v1/v2.
       if (autumnResult !== null && !autumnResult.allowed) {

apps/api/src/controllers/v1/fireclaw.ts

@@ -52,7 +52,7 @@ export async function fireclawController(
   const creditCheck = await autumnService.checkCredits({
     teamId: req.auth.team_id,
     value: totalCredits,
-    properties: { source: "fireclaw" },
+    properties: { source: "fireclaw", apiKeyId: chunk?.api_key_id ?? null },
   });
 
   if (creditCheck !== null && !creditCheck.allowed) {

apps/api/src/controllers/v2/browser.ts

@@ -213,8 +213,14 @@ export async function browserCreateController(
 
   req.body = browserCreateRequestSchema.parse(req.body);
 
-  const { ttl, activityTtl, streamWebView, recordSession, profile, integration } =
-    req.body;
+  const {
+    ttl,
+    activityTtl,
+    streamWebView,
+    recordSession,
+    profile,
+    integration,
+  } = req.body;
 
   if (!config.BROWSER_SERVICE_URL) {
     return res.status(503).json({
@@ -231,7 +237,11 @@ export async function browserCreateController(
   const autumnResult = await autumnService.checkCredits({
     teamId: req.auth.team_id,
     value: estimatedCredits,
-    properties: { source: "browserCreate", path: req.path },
+    properties: {
+      source: "browserCreate",
+      path: req.path,
+      apiKeyId: req.acuc?.api_key_id ?? null,
+    },
   });
 
   if (autumnResult !== null && !autumnResult.allowed) {

apps/api/src/controllers/v2/scrape-browser.ts

@@ -574,7 +574,11 @@ async function createSessionForScrape(
   const autumnResult = await autumnService.checkCredits({
     teamId: req.auth.team_id,
     value: estimatedCredits,
-    properties: { source: "scrapeBrowserCreate", path: req.path },
+    properties: {
+      source: "scrapeBrowserCreate",
+      path: req.path,
+      apiKeyId: req.acuc?.api_key_id ?? null,
+    },
   });
 
   if (autumnResult !== null && !autumnResult.allowed) {

apps/api/src/routes/shared.ts

@@ -148,6 +148,7 @@ export function checkCreditsMiddleware(
         properties: {
           source: "checkCreditsMiddleware",
           path: req.path,
+          apiKeyId: req.acuc?.api_key_id ?? null,
         },
         featureId,
       });