Create checkout on the server
The server selects trusted products and prices, creates the provider session, and constrains allowed return URLs. Browser input does not determine the authoritative amount, fulfillment rule, or tenant.
Provider credentials remain server-side and are supplied by the buyer for the deployed product.
Verify before changing state
Webhook signatures are verified against the raw request before payment or subscription state changes. Event handling is idempotent because providers retry and delivery order is not a business guarantee.
The application records enough provider and internal identity to reconcile an event without treating redirect success as proof of payment.
Model the subscription lifecycle
A production flow covers creation, payment status, renewal, cancellation, resumption, invoice access, failed payment handling, and reconciliation. Product access follows accepted server-side state transitions.
Fulfillment may include digital delivery or repository access, but each mechanism needs explicit retry, audit, and revocation behavior.
Keep billing tenant-aware
Catalog synchronization, checkout, subscriptions, invoices, ledgers, and fulfillment preserve tenant context. One tenant must not select another tenant’s product configuration or observe its provider records.
Amsonia supplies a foundation for these flows. Buyers still configure Stripe, taxes, pricing, customer communication, refunds, and jurisdiction-specific obligations.