curl --request POST \
--url https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"tier": "startup"
}
'import requests
url = "https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout"
payload = { "tier": "startup" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({tier: 'startup'})
};
fetch('https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'tier' => 'startup'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout"
payload := strings.NewReader("{\n \"tier\": \"startup\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"tier\": \"startup\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"tier\": \"startup\"\n}"
response = http.request(request)
puts response.read_body{
"checkout_url": "https://checkout.stripe.com/c/pay/cs_test_a1b2c3d4"
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}Create a Stripe Checkout session
Creates a Stripe Checkout session for one paid tier and answers with the URL to send the customer to. The caller names a tier; the price behind it is resolved server-side from the stable Stripe lookup key, never sent by the caller — see CheckoutRequest for why. Plan switching is rate-limited to prevent grant farming.
Checkout is an external redirect. The customer leaves for Stripe entirely and returns to a dashboard URL this operation names; nothing about the account changes here. Credits and the tier move only when the payment’s webhook arrives, which is what makes a completed payment grant exactly once however many times it is delivered.
The account’s Stripe customer is created here, on first use, replacing the placeholder a signup writes. That call is idempotent on the account, so two clicks — or two concurrent requests — converge on one customer rather than minting a second.
curl --request POST \
--url https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"tier": "startup"
}
'import requests
url = "https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout"
payload = { "tier": "startup" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({tier: 'startup'})
};
fetch('https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'tier' => 'startup'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout"
payload := strings.NewReader("{\n \"tier\": \"startup\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"tier\": \"startup\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://k8mfogcvz4.execute-api.us-east-1.amazonaws.com/prod/v1/billing/checkout")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"tier\": \"startup\"\n}"
response = http.request(request)
puts response.read_body{
"checkout_url": "https://checkout.stripe.com/c/pay/cs_test_a1b2c3d4"
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}{
"error": {
"code": "invalid_request",
"type": "invalid_request",
"message": "<string>",
"doc_url": "<string>",
"request_id": "<string>",
"retryable": true
}
}Authorizations
A Cognito access token, issued through the dashboard's own sign-up and sign-in pages (a backend-for-frontend; there is no Cognito Hosted UI) and sent as Authorization: Bearer <jwt>. Dashboard operations require this scheme and cannot be called with an API key, with no exception. GET /v1/usage and GET /v1/limits offered both schemes from 0.8.0; 0.8.1 withdrew that, because the control-plane API serves them alone and its authorizer has no API-key branch. An account_id supplied by the client is ignored; all reads/writes are scoped server-side to the authenticated account.
Body
A tier, never a price id. A price_… identifier differs between Stripe's test and live modes and between environments, so one written into a request would be correct in exactly one of them. The price is resolved server-side from the tier's stable lookup key at the moment the session is created.
It is also the safer half of the exchange. A caller-named price is a caller-named amount: any active price in the account would be accepted, including one belonging to a different product, so a customer could pay the cheapest plan's price and be checked out against any other. A tier names a row in a table only the server can read.
A tier that is bought rather than granted — Tier minus free. Each of these has a monthly price behind a stable Stripe lookup key; the free tier has neither a product nor a price, because its allowance is the session bootstrap's one-time credit grant and there is nothing to check out.
hobby, startup, growth, scale Response
A Checkout session URL.
2048
