Kamran Khan
Full-Stack Web Developer (React.js + Laravel) | Dashboards, SaaS Apps & Management Systems for Global Clients
Granting credits only when both keys can be written, and still creating the account, is the right call. Blocking the signup outright just makes support emails. Good flag on hard deletes freeing up the keys too, that's easy to miss until someone starts farming it.
Two wrinkles I'd add from running a credits-based SaaS. First, email changes: when a user updates their email in settings, the keys need recomputing, and the new key can collide with one already claimed by another row — so you either block a legitimate change or add handling for it. Second, with SoftDeletes the keys stay claimed forever, meaning a churned user who comes back a year later still can't get a trial. A separate trial_claims table with an expires_at would bound the abuse window without closing the door permanently — have you weighed that against keeping the keys on the users table?