Category 4 of 10
Payments and entitlements
Money and plan state change only through verified events and server-side rules.
v1.0 · verified on 2026-09-21
Money and plan state change only through verified events and server-side rules. Every test here runs in the payment provider's test mode.
Webhook signatures are verified against the raw body
automated Send an unsigned event, an event with an altered body, and an event signed with the wrong secret to the webhook endpoint.
All three are rejected with a 4xx status and no state change.
Duplicate and out-of-order events are handled once
automated Deliver the same event id twice and deliver invoice.paid before customer.subscription.created.
Exactly one state change per event id; the out-of-order pair ends in the correct final state.
Plan and entitlement are enforced on the server
automated Call a gated feature with the client-side plan flag edited to a higher tier and with an expired subscription.
The server refuses the gated feature in both cases.
Amounts, prices and quantities originate on the server
automated Alter the amount, currency, price id or quantity in the checkout request.
The altered request is rejected or the server recomputes the amount from its own price table.
Cancellation, downgrade and refund paths update entitlements
manual Trigger cancel, downgrade, failed renewal and refund events in the payment provider's test mode and check the account state.
Each event leaves the account with the entitlement the written rules specify, within one webhook delivery.
Dots: Starter, Growth, Scale. Compare plan limits.
Failure patterns these items catch
- criticalWebhook accepted without a signature check
The endpoint that marks orders paid or plans active trusts any request that looks like an event.
- criticalPlan limits enforced only in the UI
The app hides premium features from free users while the API serves them to any caller.
- criticalPrice or amount taken from the request
The checkout call charges whatever amount the browser sent.
- highSame event processed twice
A delivered-twice event credits a customer twice or sends two emails.
- highHandler assumes events arrive in order
The code expects subscription.created before invoice.paid, and leaves the account in the wrong state when they arrive reversed.
Ask which plan runs these items
Email with your team size, cadence and stacks. We reply within 24 hours on business days.