Stripe SaaS Billing Pack

Summary

Checkout route, signed webhook handler and a database sync that ignores duplicates and out-of-order events. Access comes from the database, never from the success page.

Checkout route

src/app/api/billing/checkout/route.ts

export async function POST(request: Request) {
  const user = await requireUser();
  const form = await request.formData();
  const lookupKey = String(form.get('lookup_key') ?? '');
  if (await activeSubscriptionId(user.id)) {
    return Response.redirect(`${APP_URL}/api/billing/portal`, 303);
  }
  const prices = await stripe.prices.list({ lookup_keys: [lookupKey], active: true, limit: 1 });
  const price = prices.data[0];
  if (!price) return Response.json({ error: 'Unknown plan' }, { status: 400 });
  const customer = await getOrCreateCustomer(user);
  const session = await stripe.checkout.sessions.create({
    mode: 'subscription',
    customer,
    client_reference_id: user.id,
    line_items: [{ price: price.id, quantity: 1 }],
    subscription_data: { trial_period_days: 14, metadata: { user_id: user.id } },
    allow_promotion_codes: true,
    success_url: `${APP_URL}/billing/success?session_id={CHECKOUT_SESSION_ID}`,
    cancel_url: `${APP_URL}/pricing`,
  });
  if (!session.url) return Response.json({ error: 'No Checkout URL' }, { status: 500 });
  return Response.redirect(session.url, 303);
}

Webhook route

src/app/api/stripe/webhook/route.ts

export async function POST(request: Request) {
  const signature = request.headers.get('stripe-signature');
  const secret = process.env.STRIPE_WEBHOOK_SECRET;
  if (!signature || !secret) return new Response('Missing signature', { status: 400 });
  const body = await request.text();
  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(body, signature, secret);
  } catch {
    return new Response('Invalid signature', { status: 400 });
  }
  try {
    await handleStripeEvent(event);
  } catch (err) {
    return new Response('Handler error', { status: 500 });
  }
  return new Response(null, { status: 200 });
}

Sync rules

Next steps

stripe listen --forward-to localhost:3000/api/stripe/webhook --latest
node webhook-doctor.mjs probe --url http://localhost:3000/api/stripe/webhook --secret whsec_...
node webhook-doctor.mjs scan ./src

The probe must pass all six checks (valid, valid pretty-printed, forged, unsigned, stale, duplicate).