Christian Lecherbauer
Problem
There's no way to read the org's credit balance from a server using an API token. Both GET /org and GET /subscription/{id} reject
private API tokens (401 Invalid Key) and only accept the WorkOS dashboard session JWT, which expires hourly and can't be renewed
server-side. API tokens (tag: private/public) offer no scope for this either.
Use case
We run a prepaid setup and want our backend to show the remaining Vapi credit on an internal ops page and alert before it runs dry
— the same "don't run out mid-call" need your dashboard already serves, just automated. Right now the only options are reading it
manually in the dashboard or scraping a short-lived session token, neither of which works for monitoring.
Proposed solution
Either:
  • a read-only scope (e.g. billing:read) selectable when creating a private API token, or
  • a dedicated endpoint (e.g. GET /credits) returning the current balance, reachable with a normal private API key.
This exposes only a single number, not payment details, so the security surface is minimal — while keeping full billing/org data
behind the dashboard login as today.