Concepts

Credits & Billing

EdgeProtect uses a pay-per-call credit model. Every successful call debits one credit from the organisation that owns the API key. Credits are shared across the REST API and the EdgeProtect MCP server.

How charging works

The bearer token and IP allowlist are verified.
If verification passes, one credit is debited from your organisation's balance.
The request runs and the response is returned.

Authentication and argument-validation failures (400 / 401) never consume a credit.

Automatic refund on failure

The debit happens before the request executes so concurrent calls cannot race past your balance. If the request subsequently errors or times out, the credit is automatically refunded with no action required on your part. Quote the x-request-id header in any support email to info@edgeprotect.io and we can trace the call end-to-end.

What is and is not charged

Call type	Charged?
Successful REST or MCP tool call	1 credit
Call that errors or times out	0 credits (refunded)
Argument validation failure (`400` / `-32602`)	0 credits
Authentication failure (`401` / `-32001`)	0 credits
MCP `initialize`, `tools/list`, `ping`, `notifications/*`	0 credits
MCP `account_status` tool	0 credits

Reading your balance

Every charged response includes the post-call balance in both a header and the response body.

Header: x-credits-remaining: 9998
Body: meta.credits

{
  "meta": {
    "credits": {
      "charged": 1,
      "remaining": 9998
    }
  }
}

For the MCP server the same information appears in result._meta.edgeprotect.credits:

{
  "credits": {
    "charged": 1,
    "remaining": 9998,
    "refunded": false
  }
}

You can also call the account_status MCP tool at any time to check your balance without spending a credit.

Insufficient credits

When the balance drops to zero, the API responds before any work runs:

{
  "error": "insufficient_credits"
}

The MCP server returns JSON-RPC error code -32002 with the message insufficient_credits.

Top up from Settings → Billing on edgeprotect.io. Credits are applied to your organisation immediately after a successful payment.

Organisation-wide pool

Credits belong to the organisation, not to individual API keys. All keys created under the same organisation draw from the same pool. If you have multiple keys in use simultaneously, their calls all debit the shared balance.

Pricing

Credit pricing, bundle sizes, and organisation-specific terms are shown on the Settings → Billing page of your dashboard. Contact info@edgeprotect.io for volume or enterprise pricing.

Auditing usage

The dashboard Usage tab shows per-key, per-endpoint, and per-day call counts and credit spend. You can download a CSV export for any date range.

For ad-hoc reconciliation, every response includes a unique x-request-id header. Reference it in any support email and we can trace the call end-to-end.