Documentation

Billing sandbox

This environment exercises the future checkout and licensing path without enabling production charging. Its Worker accepts Stripe test mode only.

Purpose

The skeleton connects a static Cloudflare Pages site to an independent Cloudflare Worker and D1 database. Card entry occurs only on Stripe-hosted Checkout. The desktop app can later claim a verified entitlement without treating an email address as authentication.

Trust flow

1. The browser asks the Worker to create a test Checkout session.
2. The Worker selects the server-side Stripe Price ID and returns a Stripe URL.
3. Stripe redirects the browser after test-card entry.
4. The page waits; the redirect itself changes no payment state.
5. A signed Stripe webhook becomes the authoritative payment event.
6. An unguessable status capability can retrieve a one-time claim token.
7. The app exchanges that token for a device-bound entitlement.

Operator steps

Account connection, D1 creation, Stripe test products, encrypted secrets, migration, deployment, and webhook registration are intentionally separate gates. Use the repository runbooks rather than pasting credentials into this website or source control.

npm install
npm run check
npm test
npm run build
npm run cf:dry-run

Known limits

• Production configuration is a disabled template only.
• The website account area is a non-authenticated shell and cannot manage devices yet.
• Trial mode remains disabled pending a product decision.
• Legal and refund documents are launch-blocked drafts, not approved policies.
• Signed macOS distribution is a separate release gate.