Implementation recipes
These are not feature bullets. They are the guides that ship inside the product, on the Implement tab of each module. Each one carries a goal, prerequisites, the full file inventory, ordered steps with real code, verification at every stage, and a definition of done. Below is what each one covers.
Showing 46 of 173 recipes.
One entitlement decision your product code can ask anywhere: allow, deny, or a limit, resolved from plan defaults, global kill switches and per-org overrides an admin can change without a deploy. Enforcement happens server-side before anything is written, unknown keys deny by default, and the UI shows the same decision the server enforced.
reason strings the UI can show
Ship a feature to ten percent of tenants and keep it there. Membership in the canary is stable, so no customer sees a feature appear and vanish between requests, and you raise the percentage from the admin panel without a deploy. A single customer can still be force-enabled ahead of the rollout.
same tenant stays in the canary
Lemon Squeezy checkout, overlay or hosted, with Lemon Squeezy acting as merchant of record so tax and receipts are handled for you. The buying organization travels through checkout to signature-verified webhooks, so a completed purchase raises that workspace's Pro limits and a cancellation drops them back to free.
tying an anonymous checkout to the right org
A billing webhook without real signature checking is a public endpoint for granting yourself a paid plan. This closes that: signatures are checked in constant time over the exact bytes Lemon Squeezy signed, stale or malformed ones are refused, and a redelivered event lands as a recorded duplicate instead of a double-applied upgrade.
signing over the exact raw body
Created and cancelled are the easy two. This covers the rest: payment failures move a customer to past due instead of an instant downgrade, pauses and expiries change access when they should, and a cancelled subscription keeps what was paid for until the period actually ends. Every transition is tested against real payload shapes.
cancelled but still paid through period end
Sell a lifetime deal, a plugin or a desktop app through Lemon Squeezy: each purchase issues a license key tied to the buying organization, a public endpoint validates and activates it, and per-device activation limits are enforced. Buyers see their activated devices and can free a slot on their own.
freeing a device slot without killing the key
Webhooks get lost to deploys, timeouts and exhausted retries. A nightly sweep pages through every Lemon Squeezy subscription, compares each against your own records, repairs any drift it finds, and reports how many rows it corrected, so a lost event becomes a logged repair instead of a quiet billing mystery.
paying customers silently missing their access
Customers change plan and update their card themselves, from one panel in your billing page. Plan changes go through Lemon Squeezy with an explicit proration choice, portal links for card updates and cancellation are signed, short-lived and minted fresh on each click, and the resulting webhook keeps your entitlements in step.
expiring portal links pasted into emails
Sell Pro through Paddle as merchant of record, so tax and invoicing are their problem. Checkout opens as an overlay in your app, the buying organization is carried through the transaction, and verified webhooks turn an activated subscription into raised limits and a cancellation back into the free plan, proven end to end in sandbox.
sandbox events proving the entitlement path
Paddle sends far more than activated and canceled. Trialing, past due, paused and resumed each change what a customer is owed, and every one of them is mapped to the entitlements your product enforces. Retries are absorbed rather than double-applied, and a customer who pauses or resumes sees access change within one webhook.
paused and resumed subscriptions keeping entitlements honest
Mid-cycle plan changes on Paddle with the right proration mode: upgrades charged pro rata and applied at once, downgrades scheduled for period end with a stated effective date. Customers see a preview of the charge before confirming, and the resulting webhook keeps your records and their entitlements in step.
picking the correct proration mode
Most declines are a stale expiry date, not a customer leaving. Past-due Paddle subscriptions keep working through a defined grace period while the customer sees escalating banners and emails that link straight to updating their card, and the downgrade happens automatically, exactly once, only when the window closes without a recovered payment.
grace period sized to recover, not to leak
A merchant of record handles tax in every country, but that only reaches buyers if the pricing page shows it. Visitors see their own currency with tax presented the way their country expects, results are cached per country to stay inside Paddle's rate limits, and base prices appear when the preview is unavailable.
per-country caching under preview rate limits
Most Paddle launch incidents are one id still pointing at sandbox. Here environment selection comes from a single source that cannot be half-switched, price ids resolve per environment, a preflight check fails loudly on any mismatch, and a written cutover order covers webhook registration and replaying events from launch day.
sandbox ids surviving into the live deploy
Sell a Pro subscription through Polar and have the purchase raise that organization's limits on its own. Polar's Convex component owns checkout, subscription state and webhook ingestion, so your product code stays unchanged, an upgrade page shows the live plan, and a cancellation restores free limits as automatically as the upgrade granted them.
checkout to entitlement with zero product edits
Enforce paid seat limits when an invitation is created: pending invitations count toward the cap, and removing a member immediately lowers the provider’s billed quantity. The plan card shows seats used against seats paid for.
billed quantity drifting from real membership
Give new organizations full Pro limits for fourteen days with no card. A countdown banner appears in the final week and turns urgent near the end, expiry drops the organization back to free within the hour, a second trial for the same organization is refused, and anyone who upgraded mid-trial keeps their paid limits untouched.
refusing a second trial to the same org
Upgrades take effect immediately with a prorated charge; downgrades wait for the period boundary. Before anyone confirms, a preview compares their current usage against the smaller plan's limits and warns about anything that would no longer fit, and a scheduled downgrade stays visible with what is active today and what changes on which date.
customers sitting above the new plan's cap
Cancellation that keeps access until the paid period ends and records a structured reason for churn analysis. The save offer matches the stated reason, a cheaper plan for price, the roadmap for a missing feature, support for reliability, and a customer who changes their mind reactivates in one click any time before the boundary.
reactivation before the period boundary
A failed card should not end the relationship. Past-due organizations keep read access through a seven-day grace window while writes are held with a clear message, a three-email recovery sequence runs alongside an in-product banner, and full limits return on their own the moment a retry clears.
read-only grace instead of instant cutoff
Billing events your handler rejected are kept with their full payload and error instead of vanishing into provider retry limits. An operator replays them from the admin area once the fix ships, and a reconcile pass checks the provider's live subscription and repairs anything that drifted during the outage. Unverified events are still refused outright.
events lost while the deployment was down
A monthly and annual pricing page driven from one plan catalog, so what marketing shows and what the server grants cannot drift apart. The annual saving is computed rather than typed, discount codes survive into checkout, and a member who hits a limit sees the exact plan that raises it, one click from upgrading.
discount code surviving the checkout hop
Finance users get every past invoice with amount, status and date, plus downloadable receipts through short-lived provider links. Invoices are read live from the billing provider so a refund never leaves a stale copy behind, and a separate billing email and company address stop receipts landing in a founder's personal inbox.
short-lived receipt links, billing contact split from owner
Money is not a normal permission. Members without billing rights lose the nav entry, the page and every server call behind it, while everyone can still see which plan the workspace is on. Each plan change is recorded with who made it and the plan before and after.
audit trail with before and after plan
Seller onboarding on Stripe Connect's current account model: sellers complete hosted onboarding, buyers pay through a destination charge that routes the money to the seller and takes your platform fee, and charging is held back until the seller's payout capability is actually active, so money never lands somewhere it cannot leave.
charging before payout capability is live
A marketplace refund pulls money from the seller's balance by default, and the platform fee does not come back unless you say so. This settles that policy: full and partial refunds reverse the fee proportionally, the action sits behind a permission and a stated reason, and every refund records who issued it.
platform fee silently unreversed on every refund
Sellers who onboarded months ago can quietly become restricted when Stripe asks for new documents. Each seller's capability status is mirrored locally, the seller sees a banner naming what Stripe wants and the deadline, with one click into re-onboarding, and new charges for a restricted account are refused before a buyer ever enters a card.
first symptom is usually a bounced payout
Sellers see available balance, pending balance and the next payout date inside your product, with every payout event kept in a history that answers where is my money. A bounced payout marks the account, tells the seller what actually went wrong, and routes them straight to fixing their bank details.
failed payouts nobody notices until the seller does
Chargebacks on marketplace charges land on the platform balance even though the seller kept the money. Each dispute is captured with its evidence deadline, liability goes to platform or seller by an explicit policy that debits the responsible party, sellers submit evidence through your product, and reminders fire before the window closes.
who eats the chargeback, decided in advance
Connect bugs show up as money in the wrong account. This recipe seeds test connected accounts in known requirement states, pins fee-split and reversal arithmetic — including the rounding cases — with unit tests, and drives onboarding, charge, refund and payout against Stripe test mode, so the whole flow is verifiable in CI without production keys.
fee and reversal maths pinned by tests
Stripe subscription billing wired end to end: hosted Checkout with tax collection, signature-verified webhooks, and the Customer Portal for self-serve changes. A price-to-plan mapping turns payments into entitlements, so a completed test purchase raises an organization's limits and a portal cancellation drops them back to the free plan.
price id mapped to real entitlements
Stripe Tax configured properly: billing addresses and VAT numbers are collected and validated at Checkout, so an EU business is zero-rated under reverse charge while a consumer on the same price pays local VAT. The applied tax is recorded for invoices, and a threshold monitor flags the next country before you owe registration there.
registration thresholds before you owe money abroad
Prove the billing path against real Stripe events instead of hand-written fixtures. A scripted customer on a Stripe test clock runs through trial expiry, renewals and failed payments in seconds, with entitlements asserted after every advance, and the rehearsal is repeatable enough to run before each release.
a year of renewals in under a minute
Wallets, Link, ACH and SEPA accepted alongside cards, with new methods enabled from the Stripe dashboard rather than a deployment. Card buyers get access within seconds, while delayed-settlement payments sit in a visible pending state and become entitlements only once the money actually clears.
SEPA clearing days after checkout completes
European renewals that need bank authentication no longer look like churn. When an off-session charge asks for 3D Secure, the customer gets an email and an in-product prompt linking to Stripe's hosted invoice page, keeps access for a bounded 72-hour window, and drops into ordinary dunning only if they never authenticate.
off-session renewals that require 3D Secure
Test and live Stripe data stay apart. Each deployment carries its own restricted key, webhook secret and endpoint, a startup check refuses to boot billing when a live key meets a test price, and the go-live sequence — Radar and tax prerequisites included — is written down so the first real charge is uneventful.
live key paired with a test price id
Usage-based pricing where the invoice and the in-product usage page agree. Recorded usage flows to Stripe billing meters within the minute, prices in tiers with a free allowance, and shows a projected charge next to the numbers customers see. A nightly reconciliation names any organization whose Stripe total drifts from your own.
Stripe's meter total drifting from yours
Retry policy and customer self-serve rights become reviewable code rather than settings someone once clicked in a dashboard. The portal grants plan switching and cancellation while withholding seat quantity changes, failed renewals retry four times over three weeks before going unpaid, and every portal session is pinned to the managed configuration.
portal permissions drifting from what was agreed
One-off charges land on the customer's next subscription invoice instead of a separate receipt, mid-period downgrades issue a credit note for the unused portion rather than cash, and a full refund drops the organization to free limits with an audit entry naming the operator — so support already knows what a refund does to access.
credit note versus cash refund on downgrade
Every Stripe write goes through one client with the API version pinned, an idempotency key derived from the organization and intent, and backoff for rate limits and lock contention. A test replays a timed-out action and proves it produces one charge, never two — and a dashboard upgrade can no longer reshape your webhooks unreviewed.
a timed-out retry charging the customer twice
Plan limit checks that stay fast as tenants grow: creating a project reads a maintained per-organization count in logarithmic time instead of scanning every row. The count is kept in step with writes transactionally, and a backfill migration covers existing data and proves the maintained total equals the real one.
keeping the count exact under concurrent writes
High-frequency meters stop contending on a single document. Metrics you declare hot spread their increments across shards so hundreds of concurrent writes all land without colliding, quieter meters keep their exact per-user rows, and the usage page reads both kinds in the same view. Billing still settles on exact event totals.
write contention on one hot document
Retries, double-clicked buttons and redelivered webhooks each count once. Every metered event carries a dedupe claim taken in the same transaction as the increment, so a replay is recognized and reported as a duplicate without touching any total. Expired claims are swept nightly, keeping the dedupe table bounded.
sweeping expired claims so the table stays bounded
Twelve months of usage rendered without scanning a year of rows. A resumable nightly job folds daily records into one monthly total per organization and metric, raw rows are pruned once they pass the ninety-day retention window, and the trend chart on the usage page stays complete even for months with no activity.
zero-filled gaps instead of missing bars
Members live inside Better Auth, so seats cannot be counted like a local table. Each organization carries a mirrored seat count that makes the check cheap, an invite past the plan's seat entitlement is refused before the invitation ever sends, and a nightly reconcile corrects any row that drifted from the real member list.
counting seats across a component boundary
Take an existing feature — document exports — and make it billable. One meter declaration drives everything: a daily included allowance, a quota gate that warns the user before it refuses the request, usage-page bars, and closed billing windows that report overage to your payment provider with the invoice math already settled.
warning at eighty percent, blocking at the cap