← All posts

Guides

Stripe and SaaS billing, built to hold up

The Stripe demo is one Checkout call. Production billing is webhooks you trust, proration that reconciles, dunning that recovers cards, entitlements that gate features, and disputes you can actually win. These are the guides for that second part.

Billing is the one subsystem where a bug is a refund, an angry email, or a chargeback — so it earns more rigor than the rest of your app. The mistake I see most is treating Stripe as the source of truth for your product. It is not: Stripe owns the money movement, your database owns who-can-do-what. The webhook is the bridge between them, which is why verifying its signature and processing it idempotently is the foundation everything else sits on.

From there it is mostly about being honest with state. A subscription is not 'active' because Checkout returned — it is active because a verified webhook said so. A customer keeps access until the period they paid for ends, not the second a card fails. Usage-based billing only works if your meter is the authority and Stripe is told, not asked. Get those agreements right and the advanced pieces — Connect payouts, metered + Metronome, quota enforcement, Radar rules — become variations on the same disciplined pattern.

The guides

FAQ

How should I sync Stripe subscriptions with my database?
Treat Stripe as the billing authority and your database as the access authority, connected by verified webhooks. On each event (checkout.session.completed, customer.subscription.updated, invoice.paid/failed) you upsert the plan and status into your own tables, idempotently by event id. Your app reads access from your tables — never by calling Stripe on the request path.
Why is webhook signature verification non-negotiable?
Your webhook endpoint is a public URL that grants paid access. Without verifying the Stripe-Signature header, anyone who finds it can POST a fake "subscription active" event and unlock your product for free. Verify the signature, then make the handler idempotent so Stripe's retries do not double-apply.
Stripe, Paddle or Lemon Squeezy — which do I need?
Stripe gives you the most control and the lowest fees but leaves you to handle sales tax/VAT yourself. Paddle and Lemon Squeezy act as merchant of record, handling global tax for a higher cut. If you sell worldwide and do not want to own tax compliance, an MoR is worth the percentage; if you want control and your tax situation is simple, Stripe wins.