≈ Podlaps
Demonstration checkout. Nothing is charged and no card details are collected.

This page stops where a live build would redirect to Stripe. Card details are entered on Stripe's hosted form, never on this page.

Checkout

Subscribe to Swim

Card details are entered on Stripe

A live build redirects to Stripe Checkout, or mounts Stripe Elements in an iframe served by Stripe. In either case the card number never reaches this page. That is what keeps the page outside PCI scope.

Cancel at any time. Prices are in USD and exclude any tax calculated by Stripe at checkout.

What a live build would do

  1. POST to your server with the plan key only, never a price or an amount, since a client can tamper with both.
  2. Create a Checkout Session server-side against the price ID held in your environment config.
  3. Redirect to the session URL Stripe returns. Stripe collects the card and handles 3-D Secure.
  4. Issue the licence from the webhook on checkout.session.completed, rather than from the success redirect, which anyone can open directly.
  5. The app retrieves it. Enter that email address once in the app and it fetches the plan. Renewals and cancellations are then picked up automatically.

The full server, webhook and licence-issuing code is in site/STRIPE.md.