Skip to content

skip /usage/plan request when api key is not provided#2059

Merged
grzegorz-roboflow merged 4 commits intomainfrom
feat/dg-318-do-not-call-usage-plan-details-endpoint-without-api-key-2
Mar 4, 2026
Merged

skip /usage/plan request when api key is not provided#2059
grzegorz-roboflow merged 4 commits intomainfrom
feat/dg-318-do-not-call-usage-plan-details-endpoint-without-api-key-2

Conversation

@rafel-roboflow
Copy link
Contributor

@rafel-roboflow rafel-roboflow commented Mar 2, 2026

What does this PR do?

Prevents unnecessary HTTP requests to /usage/plan endpoint when no API key is provided. Previously, the code would make the request regardless, resulting in 401 errors.

Now get_api_key_plan returns default values immediately when the API key is empty or None... avoiding many 401 logs.

Related Issue(s): N/A

Type of Change

  • Bug fix (non-breaking change that fixes an issue)

Testing

  • I have tested this change locally
  • I have added/updated tests for this change

Test details:
Verified that /usage/plan requests are no longer made when running inference without an API key configured.

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code where necessary, particularly in hard-to-understand areas
  • My changes generate no new warnings or errors
  • I have updated the documentation accordingly (if applicable)

Additional Context

The fix returns default plan values (enterprise=True, pro=True, billed=True, etc.) when no API key is provided, maintaining backward compatibility while avoiding unnecessary network calls and 401 error logs.


Note

Low Risk
Low risk: adds a simple early-return guard to avoid an external /usage/plan request when api_key is empty, with no changes to auth, storage, or request logic when a key is present.

Overview
Prevents plan lookups from calling the remote plan endpoint when get_api_key_plan is invoked with a missing/empty api_key.

PlanDetails.get_api_key_plan now immediately returns a default plan dict (defaults for enterprise/pro/billed, etc.) with an empty api_key_hash, avoiding repeated 401s and noise when running without an API key.

Written by Cursor Bugbot for commit 643da16. This will update automatically on new commits. Configure here.

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

date_time_now: Optional[datetime.datetime] = None,
) -> Dict[str, Union[str, bool]]:
if not api_key:
return self._get_default_plan()
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Empty API key now bypasses quota enforcement checks

Medium Severity

When no API key is provided, _get_default_plan returns over_quota=False, is_enterprise=True, is_pro=True, and is_billed=True. Previously, the code would hit the /usage/plan endpoint, receive a 401, and the 4xx handler in refresh_api_key_plan_cache would set over_quota=True, is_enterprise=False, is_pro=False, and is_billed=False. The WebRTC code paths (is_over_quota) rely on over_quota to enforce usage limits — this change flips the behavior from restrictive to fully permissive for empty API keys, contrary to the PR's claim of "maintaining backward compatibility."

Additional Locations (1)

Fix in Cursor Fix in Web

Copy link
Contributor Author

@rafel-roboflow rafel-roboflow Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would need to force to return False for those, ... I guess makes sense as no-api key was given? I doubt about 'is over quota', because it's not really overquo
ta.

@grzegorz-roboflow grzegorz-roboflow enabled auto-merge (squash) March 4, 2026 09:26
@grzegorz-roboflow grzegorz-roboflow merged commit 4a256ee into main Mar 4, 2026
47 of 55 checks passed
@grzegorz-roboflow grzegorz-roboflow deleted the feat/dg-318-do-not-call-usage-plan-details-endpoint-without-api-key-2 branch March 4, 2026 09:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants