diff --git a/components/dashboard/src/start/CreateWorkspace.tsx b/components/dashboard/src/start/CreateWorkspace.tsx
index 5db5824e8dc559..aaa324a7a3d8ac 100644
--- a/components/dashboard/src/start/CreateWorkspace.tsx
+++ b/components/dashboard/src/start/CreateWorkspace.tsx
@@ -11,6 +11,7 @@ import {
     RunningWorkspacePrebuildStarting,
     ContextURL,
     DisposableCollection,
+    Team,
 } from "@gitpod/gitpod-protocol";
 import { ErrorCodes } from "@gitpod/gitpod-protocol/lib/messaging/error";
 import Modal from "../components/Modal";
@@ -25,6 +26,8 @@ import PrebuildLogs from "../components/PrebuildLogs";
 import CodeText from "../components/CodeText";
 import FeedbackComponent from "../feedback-form/FeedbackComponent";
 import { isGitpodIo } from "../utils";
+import { AttributionId } from "@gitpod/gitpod-protocol/lib/attribution";
+import { TeamsContext } from "../teams/teams-context";
 
 export interface CreateWorkspaceProps {
     contextUrl: string;
@@ -185,6 +188,11 @@ export default class CreateWorkspace extends React.Component<CreateWorkspaceProp
                     phase = StartPhase.Stopped;
                     statusMessage = <LimitReachedOutOfHours />;
                     break;
+                case ErrorCodes.PAYMENT_SPENDING_LIMIT_REACHED:
+                    error = undefined; // to hide the error (otherwise rendered behind the modal)
+                    phase = StartPhase.Stopped;
+                    statusMessage = <SpendingLimitReachedModal hints={this.state?.error?.data} />;
+                    break;
                 default:
                     statusMessage = (
                         <p className="text-base text-gitpod-red w-96">
@@ -335,6 +343,44 @@ function LimitReachedOutOfHours() {
         </LimitReachedModal>
     );
 }
+function SpendingLimitReachedModal(p: { hints: any }) {
+    const { teams } = useContext(TeamsContext);
+    // const [attributionId, setAttributionId] = useState<AttributionId | undefined>();
+    const [attributedTeam, setAttributedTeam] = useState<Team | undefined>();
+
+    useEffect(() => {
+        const attributionId: AttributionId | undefined =
+            p.hints && p.hints.attributionId && AttributionId.parse(p.hints.attributionId);
+        if (attributionId) {
+            // setAttributionId(attributionId);
+            if (attributionId.kind === "team") {
+                const team = teams?.find((t) => t.id === attributionId.teamId);
+                setAttributedTeam(team);
+            }
+        }
+    }, []);
+
+    return (
+        <Modal visible={true} closeable={false} onClose={() => {}}>
+            <h3 className="flex">
+                <span className="flex-grow">Spending Limit Reached</span>
+            </h3>
+            <div className="border-t border-b border-gray-200 dark:border-gray-800 mt-4 -mx-6 px-6 py-2">
+                <p className="mt-1 mb-2 text-base dark:text-gray-400">Please increase the spending limit and retry.</p>
+            </div>
+            <div className="flex justify-end mt-6 space-x-2">
+                <a href={gitpodHostUrl.with({ pathname: "billing" }).toString()}>
+                    <button>Billing Settings</button>
+                </a>
+                {attributedTeam && (
+                    <a href={gitpodHostUrl.with({ pathname: `t/${attributedTeam?.slug}/billing` }).toString()}>
+                        <button>Team Billing</button>
+                    </a>
+                )}
+            </div>
+        </Modal>
+    );
+}
 
 function RepositoryNotFoundView(p: { error: StartWorkspaceError }) {
     const [statusMessage, setStatusMessage] = useState<React.ReactNode>();
diff --git a/components/dashboard/src/start/StartWorkspace.tsx b/components/dashboard/src/start/StartWorkspace.tsx
index 7915b7be1001a6..ab3161c661c35b 100644
--- a/components/dashboard/src/start/StartWorkspace.tsx
+++ b/components/dashboard/src/start/StartWorkspace.tsx
@@ -528,7 +528,7 @@ export default class StartWorkspace extends React.Component<StartWorkspaceProps,
                                         try {
                                             const desktopLink = new URL(openLink);
                                             redirect =
-                                                desktopLink.protocol != "http:" && desktopLink.protocol != "https:";
+                                                desktopLink.protocol !== "http:" && desktopLink.protocol !== "https:";
                                         } catch {}
                                         if (redirect) {
                                             window.location.href = openLink;
diff --git a/components/gitpod-protocol/src/messaging/error.ts b/components/gitpod-protocol/src/messaging/error.ts
index 2b6dda0f61a619..2be88f3224d9e0 100644
--- a/components/gitpod-protocol/src/messaging/error.ts
+++ b/components/gitpod-protocol/src/messaging/error.ts
@@ -41,6 +41,9 @@ export namespace ErrorCodes {
     // 450 Payment error
     export const PAYMENT_ERROR = 450;
 
+    // 451 Out of credits
+    export const PAYMENT_SPENDING_LIMIT_REACHED = 451;
+
     // 470 User Blocked (custom status code)
     export const USER_BLOCKED = 470;
 
diff --git a/components/server/ee/src/workspace/gitpod-server-impl.ts b/components/server/ee/src/workspace/gitpod-server-impl.ts
index 792f1d3c41c1ba..572648896a5296 100644
--- a/components/server/ee/src/workspace/gitpod-server-impl.ts
+++ b/components/server/ee/src/workspace/gitpod-server-impl.ts
@@ -252,6 +252,32 @@ export class GitpodServerEEImpl extends GitpodServerImpl {
     ): Promise<void> {
         await super.mayStartWorkspace(ctx, user, runningInstances);
 
+        // TODO(at) replace the naive implementation based on usage service
+        // with a proper call check against the upcoming invoice.
+        // For now this should just enable the work on fronend.
+        if (await this.isUsageBasedFeatureFlagEnabled(user)) {
+            // dummy implementation to test frontend bits
+            const attributionId = await this.userService.getWorkspaceUsageAttributionId(user);
+            const costCenter = !!attributionId && (await this.costCenterDB.findById(attributionId));
+            if (costCenter) {
+                const allSessions = await this.listBilledUsage(ctx, {
+                    attributionId,
+                    startedTimeOrder: SortOrder.Descending,
+                });
+                const totalUsage = allSessions.map((s) => s.credits).reduce((a, b) => a + b, 0);
+
+                if (totalUsage >= costCenter.spendingLimit) {
+                    throw new ResponseError(
+                        ErrorCodes.PAYMENT_SPENDING_LIMIT_REACHED,
+                        "Increase spending limit and try again.",
+                        {
+                            attributionId: user.usageAttributionId,
+                        },
+                    );
+                }
+            }
+        }
+
         const result = await this.entitlementService.mayStartWorkspace(user, new Date(), runningInstances);
         if (!result.enoughCredits) {
             throw new ResponseError(
@@ -1922,16 +1948,16 @@ export class GitpodServerEEImpl extends GitpodServerImpl {
         return subscription;
     }
 
-    protected async ensureIsUsageBasedFeatureFlagEnabled(user: User): Promise<void> {
+    protected async isUsageBasedFeatureFlagEnabled(user: User): Promise<boolean> {
         const teams = await this.teamDB.findTeamsByUser(user.id);
-        const isUsageBasedBillingEnabled = await getExperimentsClientForBackend().getValueAsync(
-            "isUsageBasedBillingEnabled",
-            false,
-            {
-                user,
-                teams: teams,
-            },
-        );
+        return await getExperimentsClientForBackend().getValueAsync("isUsageBasedBillingEnabled", false, {
+            user,
+            teams: teams,
+        });
+    }
+
+    protected async ensureIsUsageBasedFeatureFlagEnabled(user: User): Promise<void> {
+        const isUsageBasedBillingEnabled = await this.isUsageBasedFeatureFlagEnabled(user);
         if (!isUsageBasedBillingEnabled) {
             throw new ResponseError(ErrorCodes.PERMISSION_DENIED, "not allowed");
         }
@@ -2094,7 +2120,7 @@ export class GitpodServerEEImpl extends GitpodServerImpl {
             if (costCenter) {
                 if (totalUsage > costCenter.spendingLimit) {
                     result.unshift("The spending limit is reached.");
-                } else if (totalUsage > 0.8 * costCenter.spendingLimit * 0.8) {
+                } else if (totalUsage > costCenter.spendingLimit * 0.8) {
                     result.unshift("The spending limit is almost reached.");
                 }
             } else {