Skip to main content
Stripe bills plan customers by the month and is the source of truth for a subscription’s plan, amount and status. Nothing else is sold through it: an invoice for a job is paid on the pay page; see How payments work.

​
What Stripe owns

Our side and Zoho hold copies. The engine’s plan table, kept in the backend code, maps each Stripe product to a plan name (All-Season, Heating Only, Cooling Only, Tankless) and whether it includes protection. An event naming a product missing from that table is refused: nothing is written, it is not retried, and the failure is left for a person. A new Stripe product is therefore a code change before it is sold.

​
The events we listen to

The engine listens to five events: subscription created, updated and deleted, invoice paid, and invoice payment failed. Every call is checked against Stripe’s signature and against a five-minute clock window, and an event seen before is stored once and ignored after. What follows each event, on our side and in Zoho, is on Subscriptions.

​
Keys and mode

The vault holds one Stripe secret key, a live one, and the subscription webhook’s signing secret, both in the functions’ secret group; see Environments and secrets. There is no test-mode key, so every charge Stripe makes is a real one. A webhook call the engine refuses means the signing secret in Stripe and the one the engine holds differ; rotate them together.