Billing

1. 1

   Validate the request boundary

   The checkout route creates a request id, reads the trusted origin, and passes request metadata into the billing checkout service.

   Relevant Product code

   • src/app/api/billing/checkout/route.ts
2. 2

   Resolve runtime policy

   The service reads billing policy, allowed origins, enabled models, provider selection, and setup status before accepting a checkout request.

   Relevant Product code

   • src/features/billing/server/checkout/service.ts
   • src/features/billing/server/runtime/policy.ts
3. 3

   Resolve catalog selection

   The request body is matched to a product, price, billing model, and provider-compatible checkout selection.

   Relevant Product code

   • src/features/billing/server/checkout/request.ts
   • src/features/billing/server/catalog/configuration.ts
4. 4

   Create the provider session

   The selected provider adapter creates the checkout session and returns an app response without leaking provider SDK details across the boundary.

   Relevant Product code

   • src/features/billing/server/providers/stripe/checkout.ts
   • src/features/billing/server/providers/lemonsqueezy/checkout.ts
   • src/features/billing/server/providers/dodo/checkout.ts
   • src/features/billing/server/providers/polar/checkout.ts
   • src/features/billing/server/providers/creem/checkout.ts

1. 1

   Verify before processing

   The selected route rate-limits the webhook, validates provider config, reads the raw text body, and verifies the provider signature before touching local billing records.

   Relevant Product code

   • src/app/api/webhooks/stripe/billing/route.ts
   • src/app/api/webhooks/lemonsqueezy/route.ts
   • src/app/api/webhooks/dodo/route.ts
   • src/app/api/webhooks/polar/route.ts
   • src/app/api/webhooks/creem/route.ts
   • src/lib/security/webhooks/request.ts
2. 2

   Claim the event row

   Existing processed events are returned as duplicates, stale processing leases can be reclaimed, and new events are inserted before dispatch.

   Relevant Product code

   • src/app/api/webhooks/stripe/billing/route.ts
   • src/app/api/webhooks/lemonsqueezy/route.ts
   • src/app/api/webhooks/dodo/route.ts
   • src/app/api/webhooks/polar/route.ts
   • src/app/api/webhooks/creem/route.ts
   • src/lib/security/webhooks/processing.ts
3. 3

   Dispatch by event type

   The selected provider handler routes checkout, customer, subscription, invoice, charge, refund, dispute, usage, or credit events to the supported projection handlers.

   Relevant Product code

   • src/features/billing/server/providers/stripe/webhooks/handler.ts
   • src/features/billing/server/providers/lemonsqueezy/webhooks/handler.ts
   • src/features/billing/server/providers/dodo/webhooks.ts
   • src/features/billing/server/providers/polar/webhooks.ts
   • src/features/billing/server/providers/creem/webhooks.ts
4. 4

   Project locally and notify best-effort

   The worker updates local records as the dashboard source of truth, then queues related notifications without blocking billing projection writes.

   Relevant Product code

   • src/features/billing/server/webhooks/worker.ts
   • src/features/notifications/server/delivery/queue/notify-queue.ts

Use this example as a starting point, then adapt it to your product's rules and configuration.

Environment remains the default source of truth. Settings can override it only when the provider is not locked to env.

export async function getBillingProvider(): Promise<BillingProvider> {
  const envProvider = getBillingProviderFromEnv();
  if (isBillingProviderLockedToEnv()) {
    return envProvider;
  }

  try {
    const { getAppSettings } = await import("@/features/settings/server/queries/settings");
    const settings = await getAppSettings();
    const fromSettings = normalizeProvider(settings.billing?.provider);
    return fromSettings ?? envProvider;
  } catch {
    return envProvider;
  }
}