School · Module 3 · Lesson 1 of 4
Never trust prices from the client
If the browser can set amount or price_id, a buyer can set it to zero.
Create Checkout Sessions and PaymentIntents on the server. Look up the Price ID from your own config or database keyed by a product slug the client sends, not by an amount the client sends.
Grant access only after a verified webhook (checkout.session.completed, invoice.paid), never from the success_url redirect alone.
This is the same rule for any provider: the server decides what was bought and what it costs.