Meter every prompt.
Monetize every token.
Every customer interaction.

Single-tenant SaaS architecture — your organization gets its own dedicated environment and storage. Your data is kept separate from other customers, with no shared databases and no competition for resources. This provides strong security, reliable performance, and built-in isolation for compliance and data governance needs.

Ingest token usage events via REST or batch. Each event writes the in-cluster ledger — the authoritative meter — deduplicated on `transaction_id` and recorded without ever blocking your inference path. Late events backfill into the right historical period and auto-reconcile at the next close.

Point your existing event stream at MeterBox without a translation layer: CloudEvents 1.0 (binary, structured, or batched), a Segment destination, an Airbyte destination, a long-lived Kafka consumer, or S3/GCS/Azure bucket sweeps can all be mapped directly to meter events through dotted-path field mapping, with the same deduplication and idempotency guarantees as the native API.

Price what AI actually does: `per-model_version` price bands (charge claude-3.7 differently from claude-3.5), latency-SLA premiums for sub-500ms responses, custom billing dimensions (`gpu_seconds`, `training_cycle_seconds`, `storage_gb`) with their own tier ladders, and dimensional plan-price overrides by region, deployment tier, or any key you define.

The top of the pricing ladder: claim a billable outcome ("ticket resolved", "campaign sent") priced from your catalog — it bills only after you confirm it, or when its verification window closes undisputed. Disputed claims void without charge. Solves the attribution problem that keeps outcome pricing rare.

Sub-millisecond quota checks from an in-memory cache. Model access gates, plan feature flags, configuration entitlements (per-plan scalar values like `support_sla_hours`), grace periods between soft-alert and hard-block, overage policies (block, throttle, or bill), JWT tokens embedding full entitlement state, and an in-process Node SDK (`@meterbox/entitlement-sidecar`) with stale-while-error so your gateway stays live through API outages.

Every usage event, subscription charge, overage, credit, and discount becomes a ledger entry, and each closed billing period is sealed with a verifiable SHA-256 digest — so a finalized period that was altered is detectable (SOC 1 ICFR ledger immutability). Monthly statements with day-by-day running balances and per-model breakdowns. Revenue recognition (ASC 606 / GAAP) derives deferred vs recognized revenue straight off the same ledger.

Per-agent (sub-customer) credit wallets with their own balance, spending limits, and budget caps — manage each AI agent's budget independently under a single account. Credits are temporarily set aside before use and then either charged or returned, preventing overspending even when multiple requests happen at the same time. Unused reservations are automatically released if a client disconnects or fails to complete a request.

Promotional and paid credit grants with priority and expiry ordering, balance-low webhooks, off-session auto-recharge, and credit notes for finalized invoices. Per-customer spend caps return HTTP 402 before a runaway agent can burn through the budget, and a configurable dunning policy moves past-due customers from retries to escalation.

Trial entitlements grant access to a richer plan for a specified number of days without modifying the underlying subscription. This includes reverse trials, which begin with full access and subsequently step down to the original plan. The cancellation flow presents plan-configured retention offers (for example, discounts, trial extensions, or downgrades), allowing the churn screen to attempt user retention before processing the cancellation.

Percentage-off and fixed-amount coupons with once, repeating, or forever durations. Plan restrictions, max redemptions, expiry dates, and automatic promotion code sync with Stripe.

A COGS-aware margin view (revenue vs. provider cost by model), pricing simulations that replay real usage against a draft price book, NRR and GRR retention cohorts, deterministic A/B pricing experiments, and market packaging benchmarks alongside your own catalog.

Stripe and Zuora out of the box, or Custom Invoicing for a BYO-ERP flow where your finance system owns issuance and collections against MeterBox-computed totals. Per-customer billing profiles let you override provider, currency, payment terms, and invoice numbering for tailored contracts—supporting seat-based billing, contract commitments with minimum-spend true-ups, and localized pricing by country and currency.

Configurable alerts can be triggered at 80%, 90%, 100%, or custom absolute token thresholds, with per-period deduplication to prevent duplicate notifications. Events are delivered via HTTP POST or AWS SQS with at-least-once delivery guarantees, exponential backoff retries, and a replayable delivery log, ensuring that downstream outages never result in lost events.

Every plan, customer, and credit mutation is captured in a queryable audit trail with before/after diffs and actor attribution—including per-individual operator attribution for shared admin keys. CLI and MCP clients forward `X-Operator-Id` from `METERBOX_OPERATOR_ID`, ensuring every action is attributable to a specific operator. Audit records are protected by a tamper-evident SHA-256 hash chain. Filter by event, target, and time, explore activity in the dashboard, or export to your SIEM.

Beyond the built-in Owner/Admin/Member roles, each organization defines a configurable capability matrix that authorizes privileged actions independently. This enables fine-grained delegation—for example, billing operations staff can issue account credits without also receiving permissions to publish plans. Capabilities are assigned individually rather than inherited from broad roles, while Owners always retain unrestricted access to all capabilities.

Automated billing close: we read usage from the in-cluster ledger, calculate overage, add Stripe line items, finalize invoices, mark ledger entries paid, and check coupon durations. Opt-in finance approval gate holds invoices at ready-to-issue until a human signs off.

Flexible tax handling for invoices and credit notes: use built-in jurisdiction rates for on-prem and air-gapped deployments, or connect Avalara or Anrok for automated tax calculation. A single quote endpoint lets you preview exactly what will be applied before closing, and credit notes automatically handle both net and tax amounts.

Keep your ledger as the source of truth. Invoices, payments, credit notes, and tax entries are projected into your general ledger through an NDJSON stream or NetSuite/Xero import CSVs, mapped to your accounting structure. Lazy projection means no duplicated state and no sync drift.

An hourly scan of the ledger identifies spend spikes (comparing 24-hour cost against the trailing median), churn spikes, and aggregation drift—such as customers whose integration has silently broken. Results are deduplicated daily, surfaced in the pricing insights dashboard, and trigger an `anomaly.detected` webhook on first detection.

Sell through AWS, GCP, and Azure Marketplaces without giving MeterBox access to your cloud credentials. Lightweight entitlement bridges operate in records-only mode: your seller-side handler validates marketplace events and POSTs the resolved entitlement data to MeterBox. MeterBox then maps lifecycle events to customer status and makes the customer immediately available for metering.

`@meterbox/react` provides drop-in widgets such as `PricingTable`, `PlanComparison`, `SubscriptionPreview`, `CreditBalance`, `CreditGrantsTable`, `CreditUtilization`, and `UsageChart` that self-fetch via customer-portal endpoints using short-lived customer JWTs (no admin key in browser). Alternatively, `@meterbox/customer-portal` exposes a full Account/Plans/Credits portal in one component. Built on the typed `@meterbox/node` SDK.

`@meterbox/react` drops `<PricingTable>`, `<PlanComparison>`, `<SubscriptionPreview>`, `<CreditBalance>`, `<CreditGrantsTable>`, `<CreditUtilization>`, and `<UsageChart>` straight into your product — each widget self-fetches via the customer-portal endpoints with a short-lived customer JWT, so no admin key in the browser. Or skip the wiring entirely with `@meterbox/customer-portal` — a multi-page Account/Plans/Credits portal in one component. Backed by `@meterbox/node`, a fully typed JavaScript SDK.

Technical controls mapped to NIST 800-53 out of the box — access control, audit, session management, transport, and input validation. A compliance-ready foundation that shortens your path to an audit.

TOTP multi-factor with one-time backup codes, OIDC single sign-on for Google and enterprise IdPs, bcrypt-hashed credentials, and NIST 800-63B password rules with optional breached-password screening via k-anonymity.

The application enforces sliding idle session timeouts with a hard absolute session lifetime in alignment with FedRAMP AC-11 and AC-12. It implements CSRF protection using the double-submit cookie pattern and secures session cookies with the `HttpOnly`, `Secure`, and `SameSite` attributes. Sessions automatically expire after a period of inactivity and are terminated upon reaching the maximum allowed session duration. Long-lived (e.g., 30-day) session tokens are not permitted.

User lifecycle events (signup, login, MFA, invites, role changes) land in a tamper-evident SHA-256-chained log on the control plane. A separate billing-ops trail captures plan / customer / credit mutations with before-after diffs. Both pull straight from the API with cursor pagination.

Single-tenant by design: includes a bundled in-cluster datastore and cache, with no managed or shared database. Optional encrypted off-cluster backups (using a tenant-supplied encryption key—never ours) can be sent to your S3, GCS, or Azure storage on a schedule you choose. Air-gap deployable for regulated and sovereign environments.

The OWASP secure headers baseline is applied to every response, including strict `Content-Security-Policy` with violation reporting, HSTS, and cross-origin isolation. Defense in depth is built in from day one, not bolted on after launch.

Translate a plain-English enterprise deal brief into a structured, catalog-grounded subscription proposal — plan, add-ons, limits, and the exact admin API calls to apply it, every path validated against your catalog.

Upload a signed PDF contract; extract commit amount, term, custom rates, and discounts into a reviewable proposal — sales-closed to billing-configured in one step.

Templated triggers on the webhook catalog — trial expiring, payment failed, win-back offer — rendered and sent through your own Resend / Postmark / SES account, with deliverability on the existing webhook dashboard.