Your Paddle Webhook Is Signed. The Seat Count Is Not.
Paddle custom_data can come from browser checkout code. Verify the signature, then grant seats from paid line items, not client metadata.
Sep 12, 20265 min read
Command Palette
Search for a command to run...
Latest articles
Your PayPal Refund Worked. Your Lovable App Says It Failed.
A timeout makes your app retry a PayPal refund. The second call returns 422, even though the money is already back. Test that branch before launch.
Sep 7, 20265 min read
Your AI builder shipped the Stripe code in an afternoon. Verifying it took a week.
Lovable and Bolt apps now ship real payment integrations. Mocks don't fire the retry twice and staging won't replay a 401 mid-flow. Run the lifecycle against a service twin and attach the receipt to the PR.
Sep 6, 20265 min read
Green passed. The fix granted zero seats.
An AI agent "fixed" a Stripe webhook that double-granted seats. CI went green. Paying customers got nothing. The check only asked whether the count stopped growing
Aug 11, 20266 min read
Why Paddle's subscription.activated arrives before subscription.created
You'd think webhook events fire in order. Paddle disagrees. Here's what happens and how to handle it.
Jul 30, 20263 min readOur partners kept breaking on staging. So we gave them production access. (Don't do this.)
We tried UAT, staging with IP whitelists, and finally production access — all to let partners test our API. Every option was worse than the last.
Jun 25, 20264 min read
Test AgentMail multi-tenant webhooks before they leak across tenants
AgentMail webhook creation can look done after a 200 OK. The real test is whether the persisted webhook is still scoped to the inboxes you sent.
Jun 16, 20264 min read1
Clerk webhook replay can create duplicate users unless your sync is idempotent
A narrow Clerk webhook failure: replayed user.created events can duplicate local user rows unless your handler reconciles by provider ID.
Jun 15, 20263 min read1
WorkOS directory sync webhooks need reconciliation after Okta group renames
Okta group renames can arrive through WorkOS directory sync as partial webhook events. If feature gates trust the payload, users split by cache state. Re-fetch the group and users before gating.
Jun 12, 20264 min read