Configure the buyer’s provider account
Use the buyer’s products, prices, tax configuration, branding, callback origins, and credentials. Development and production provider accounts must stay separate.
Platform provides integration surfaces; it does not decide the buyer’s pricing, taxes, refund policy, or regulatory obligations.
Keep checkout server-authoritative
The server resolves the trusted offer and creates the checkout session. Return URLs are allow-listed, and browser input cannot become the authority for amount, entitlement, or tenant.
A successful browser redirect is user experience, not proof that payment and fulfillment completed.
Verify and process provider events
Verify webhook signatures against the raw request, persist provider event identity, and make handlers idempotent. Retries and delivery reordering are expected conditions.
Subscription and payment transitions update internal state through accepted server-side rules, with enough evidence for later reconciliation.
Make fulfillment recoverable
Digital delivery or repository access needs explicit retry, audit, revocation, and operator recovery paths. A completed payment must not be lost because a downstream provider was temporarily unavailable.
Test duplicate events, delayed events, failed fulfillment, cancellation, refund, and cross-tenant attempts before production use.