v0.4.0

Highlights

• Billing on the deployment's own provider keys. Set KEERA_PROVIDER_API_KEY and every organisation's models of that provider use the deployment's key. Each organisation is billed at the provider's list price. KEERA_PROVIDER_DISCOUNT records your own discount, so operators see the provider cost and the margin. No one else sees the margin. keera billing and Administration → Billing show the monthly bill, also as CSV. See docs/billing.md.
• Pay in advance by card. With a PostFinance Checkout account, organisations buy credit in CHF by card, TWINT or PostFinance Pay. Keera never sees the card. keera billing topup, auto-topup, credit, payments and forget-card cover the rest. When the credit runs out, calls on the deployment's keys get 402 credit_exhausted, and the organisation's own models keep working. Operators can grant credit (keera billing grant) or bill an organisation by invoice (keera billing invoiced on). Settings: KEERA_POSTFINANCE_SPACE_ID, _USER_ID, _AUTH_KEY, KEERA_BILLING_CHF_PER_USD and KEERA_BILLING_VAT. See docs/billing.md#pay-in-advance.
• Self-service sign-up. With KEERA_OIDC__SIGNUP=true, someone whose sign-in matches no organisation can create one or accept an invitation. A new organisation starts limited: it cannot use models, MCP servers or sandboxes inside your network until its first card payment. Such requests are refused with org_limited. Operators can lift the limit earlier with keera org set --lift-limit or Organisations → Lift limit. See docs/sso.md#letting-people-sign-up.
• CSCS is a new inference provider, next to Infomaniak, stepping stone and Phoeniqs.
• Codex in Connect client. The panel and keera connect codex write a ~/.codex/config.toml that points at the gateway over the Responses API.
• Cache-write and long-prompt prices. Anthropic, and OpenAI from gpt-5.6 on, charge more for prompt tokens they write to their cache. Keera now bills these tokens at the cache-write rate. Models that cost more for a long prompt, such as claude-haiku-5-5 above 100,000 tokens, are charged the higher prices past that length. The provider table contains both, and a catalogue entry can set its own long_prompt.

On the deployment's keys

A model on a deployment key works differently from one with an organisation's own key:

• It takes no API key of its own and always goes to the provider's own address.
• Its prices are the list prices. Model ids that are not in the price table are refused.
• Hosted tools such as web search are removed from requests. So are fields that cost extra, like speed, inference_geo and expensive service_tier values. X-Keera-Removed-Fields lists what was removed.
• OpenAI Responses requests are sent with store off. Requests that use previous_response_id, conversation or background are refused.
• The provider has 15 minutes to start answering. If a client hangs up, the gateway keeps reading until the usage record arrives, so nothing goes unbilled.
• Filter and router calls to such a model are billed too, and so are keera model|filter|router check.

Security

• KEERA_UPSTREAM_PRIVATE lists the host names inside your network that organisations may reach, such as keera-engine. Every other private address is blocked, even behind a public name that resolves to it. Sign-up requires this setting.
• The default KEERA_UPSTREAM_DENY now also blocks Alibaba Cloud's metadata address and Azure's WireServer.
• Administrators can only give a sandbox class an image from the catalogue file, one under a prefix in KEERA_SANDBOX_IMAGES, or the image the class already has. Sandbox pods pull with the deployment's credentials, so any other image needs an operator.
• A sign-up provider that accepts any domain refuses sign-ins without email_verified: true.
• Sign-up cannot be combined with ADMIN_GROUPS on any provider. The gateway refuses to start if both are set.
• Misspelt KEERA_PROVIDER_* settings and incomplete payment settings stop the start.

Panel and CLI

• --price-cache-write on keera model add|set, and a Cache write price field in the panel. The panel also shows long-prompt prices.
• For a model on a deployment key, the panel hides the API key field and says that use is billed to the organisation.
• keera org list marks limited organisations.
• The CLI's help is shorter and links to the docs for details.
• The first-run checklist's set-up message is simpler.

Docs and development

• New: docs/billing.md. docs/sizing.md is now Retention and sizing in docs/install.md.
• docs/gateway.md notes that Redis Cluster is not supported. Use a single Redis endpoint.
• compose/models.dev.yaml is gone. make dev now generates it from compose/models.yaml into build/.

Breaking changes

• Start with a new database. The schema changed in place, so a v0.3.0 database cannot be upgraded.
• Claude subscriptions are off by default. Set KEERA_CLAUDE_SUBSCRIPTIONS=true to keep them. Without it, existing subscription models and keys are refused with subscriptions_off, and a catalogue file that contains a subscription model stops the start.
• Sandbox class images are restricted for administrators, as described above. Add custom registries to KEERA_SANDBOX_IMAGES.
• compose/models.dev.yaml was removed. Anything that pointed KEERA_MODELS_FILE at it needs a new path.