Stripe web store

How it fits together

You keep your existing Stripe Checkout. Tierux never sells for you and never touches your Stripe secret key beyond a read-only restricted key you provide. The flow: a signed-in user buys through your Stripe Checkout, and on the success page you make one call to Tierux to verify the completed session — Tierux confirms it against your Stripe account and grants the entitlement.

Two honest constraints for v1: the buyer must be a signed-in Firebase user of your app (the checkout is bound to their uid), and only subscriptions are supported; one-time purchases are not available yet. This uses your Stripe account — it is entirely separate from how Tierux bills you.

Create a restricted key + webhook in Stripe

In your Stripe dashboard, create a restricted key with read access to Checkout Sessions, Subscriptions, and Invoices (no write scopes needed). Then add a webhook endpoint pointing at Tierux, subscribed to the subscription lifecycle:

// Webhook endpoint URL (replace <appId> with your Tierux app id)
https://tierux.com/api/v1/stripe/webhook/<appId>

// Events to send
checkout.session.completed
customer.subscription.updated
customer.subscription.deleted
invoice.paid
invoice.payment_failed
charge.refunded

Copy the endpoint's signing secret (whsec_…) — you'll hand both it and the restricted key to Tierux next. Both are encrypted at rest and never shown again.

Connect it with your AI agent

Ask your agent (over the Tierux MCP) to run setup_stripe_web and create_product_mapping. Like every Tierux write, it previews first and only persists after you confirm:

Connect my Stripe web store: call setup_stripe_web with my restricted key
and webhook signing secret, then call:
create_product_mapping(productId: "price_xxx", entitlementId: "pro",
  productType: "subscription", appId: "app_xxx")
Show me the preview before confirming.

app_xxx is returned by create_project and is also shown in the dashboard; use it for subsequent MCP calls and SDK initialization.

The mapping ties a Stripe price id (price_…) to a Tierux entitlement, exactly like a Play/App Store product maps to one.

Create the checkout on your server

Use your existing Stripe code. The two things Tierux needs: the buyer's Firebase uid as client_reference_id, and a success_url that carries the session id back.

// your server — Stripe SDK
const session = await stripe.checkout.sessions.create({
  mode: "subscription",
  client_reference_id: firebaseUid,        // the signed-in buyer
  line_items: [{ price: "price_pro_web", quantity: 1 }],
  success_url: "https://your.app/success?session_id={CHECKOUT_SESSION_ID}",
  cancel_url: "https://your.app/pricing",
});
// redirect the buyer to session.url

Verify the completed session

On your success page, verify with the buyer's Firebase ID token (never an API key). Tierux re-checks the session against your Stripe account and grants the entitlement:

// your success page
const params = new URLSearchParams(window.location.search);
const checkoutSessionId = params.get("session_id");
const idToken = await firebase.auth().currentUser.getIdToken();

const res = await fetch("https://tierux.com/api/client/apps/<appId>/purchases/stripe/verify", {
  method: "POST",
  headers: { "Content-Type": "application/json", Authorization: `Bearer ${idToken}` },
  body: JSON.stringify({ checkoutSessionId }),
});
const result = await res.json();
if (result.active) unlockPro();

After that first verify, the webhook you configured in step 2 keeps the entitlement in sync — renewals extend it, cancellations and refunds revoke it — with no further work from you.