feat(api): public API plan gating, docs auth, and dashboard snippets (#701)

* fix(automation): align public API plan gating across cloud and self-hosted

Add shared canUsePublicApi helper so cloud allows Early Adopter and
Enterprise while self-hosted requires Enterprise. Update the API key
dashboard page and backend key creation checks to use the same rules.

Co-authored-by: Rotimi Best <[email protected]>

* docs(api): document bearer auth on public API reference

Add shared OpenAPI enrichment with bearerAuth security scheme and
authentication instructions. The interactive reference now loads an
enriched spec with Authorize support, and the API guide explains how
to create and use org API keys.

Co-authored-by: Rotimi Best <[email protected]>

* feat(dashboard): add API quick-start code snippets on automation page

Mirror the MCP client setup section with cURL, JavaScript, and Python
examples that show how to authenticate public API requests with org keys.

Co-authored-by: Rotimi Best <[email protected]>

* ci(openapi): republish spec when public API OpenAPI helpers change

Co-authored-by: Rotimi Best <[email protected]>

* feat(dashboard): add Go snippet to API quick-start examples

Co-authored-by: Rotimi Best <[email protected]>

* docs(api): use /org/*/api and clarify dashboard key generation path

Co-authored-by: Rotimi Best <[email protected]>

* fix(api): escape backticks in OpenAPI description template literal

Greptile flagged that unescaped backticks around * in
PUBLIC_API_OPENAPI_DESCRIPTION evaluated to NaN and dropped auth docs
from the Scalar spec. Also use plan-specific snackbar message on upgrade.

Co-authored-by: Rotimi Best <[email protected]>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Rotimi Best <[email protected]>

apps/api/scripts/upload-openapi-spec.ts

@@ -9,6 +9,7 @@ import { app } from '../src/app';
 import { env } from '@cio/core/config/env';
 import { generateSpecs } from 'hono-openapi';
 import { join } from 'path';
+import { enrichPublicApiOpenApiSpec } from '@cio/utils/openapi/public-api';
 
 interface UploadOptions {
   key: string;
@@ -32,17 +33,12 @@ function filterPublicApiSpec(spec: Record<string, unknown>) {
       })
     : undefined;
 
-  return {
+  return enrichPublicApiOpenApiSpec({
     ...spec,
     openapi: spec.openapi ?? '3.1.0',
-    info: {
-      title: 'ClassroomIO Public API',
-      version: '1.0.0',
-      description: 'Public API for managing organizations, audience members, and courses in ClassroomIO.'
-    },
     paths: publicApiPaths,
     tags
-  };
+  });
 }
 
 class OpenAPISpecGenerator {

apps/api/src/services/organization/automation-usage.ts

@@ -1,3 +1,4 @@
+import { env } from '@cio/core/config/env';
 import { AppError, ErrorCodes } from '@api/utils/errors';
 import {
   countActiveOrganizationApiKeys,
@@ -12,11 +13,11 @@ import type { TOrganizationApiKey, TOrganizationApiKeyType, TPlan } from '@db/ty
 import {
   AUTOMATION_TYPE,
   getMcpAutomationCategory,
+  canUsePublicApi,
   getMcpAutomationLimits,
   MCP_TOOL_CREDIT_COST,
   type TMcpToolName
 } from '@cio/utils/plans';
-import { PLAN } from '@cio/utils/plans/constants';
 
 export type OrganizationAutomationUsageSummary = {
   type: TOrganizationApiKeyType;
@@ -59,8 +60,18 @@ export async function assertOrganizationAutomationKeyCreationAllowed(
 ): Promise<void> {
   const planName = await getOrganizationPlanName(organizationId);
 
-  if (type === AUTOMATION_TYPE.API && planName === PLAN.BASIC) {
-    throw new AppError('Public API keys require an Early Adopter or Enterprise plan', ErrorCodes.UPGRADE_REQUIRED, 403);
+  if (type === AUTOMATION_TYPE.API) {
+    const isSelfHosted = env.PUBLIC_IS_SELFHOSTED === 'true';
+
+    if (!canUsePublicApi(planName, isSelfHosted)) {
+      throw new AppError(
+        isSelfHosted
+          ? 'Public API keys require an Enterprise plan'
+          : 'Public API keys require an Early Adopter or Enterprise plan',
+        ErrorCodes.UPGRADE_REQUIRED,
+        403
+      );
+    }
   }
 
   if (type !== AUTOMATION_TYPE.MCP) {