Your AI agent can build the app.
Make sure it gets you paid.
Paywall Kit gives Claude Code, Cursor, Codex, Lovable or Bolt the prompts, rules and reference code to add Stripe payments to your app the right way: verified webhooks, server-side access checks, refunds and cancellations handled.
One-time payment · instant download · 14-day refund if it isn't useful
The billing bugs AI agents write over and over
/success gets Pro, paid or not.curl can fake "payment succeeded".isPro the client can writeA table without row-level security, or a flag in localStorage.NEXT_PUBLIC_STRIPE_SECRET_KEY. Enough said.None of these show up when you test the happy path, which is why they ship. The kit makes your agent avoid them and gives you a test script that catches them.
What's inside
| File | What it does |
|---|---|
QUICKSTART.md | The afternoon plan, 9 steps from "free app" to "live payments". |
PROMPTS.md | 9 copy-paste prompts (plan, schema, server code, webhook, gating, pages, tests, security pass, go-live) plus a self-review prompt. |
AGENTS-payments.md | A payments rules block for AGENTS.md / CLAUDE.md / Cursor rules, so your agent stops improvising billing. |
code/ | Reference implementation for Next.js App Router + Supabase: Checkout, a verified and idempotent webhook, Customer Portal, entitlements, plan map, upgrade button. Type-checks against stripe@23 and next@16. |
LOVABLE-BOLT-SUPABASE.md | New in v1.1. For Lovable, Bolt and other Vite + Supabase apps: setup on Supabase Edge Functions, the --no-verify-jwt fix for the webhook 401, a troubleshooting table and 5 builder prompts. |
code/supabase/functions/ | New in v1.1. Deno Edge Functions: a webhook verified with constructEventAsync on the raw body, idempotent, writing access with the service role; plus checkout and Customer Portal functions. Passes deno check, and includes an offline test (10 checks, no accounts needed). |
001_billing.sql | Billing tables with row-level security: only the webhook writes, and each user can read only their own row. |
002_is_pro.sql | New in v1.1. is_pro() for row-level security policies, so Pro-only data is locked in the database instead of just hidden in the UI. |
TESTING.md | A Stripe CLI test script covering happy paths, failure paths, attacks and retries, with test cards. |
GO-LIVE.md | Switch-to-live checklist: keys, webhook events, receipts, statement descriptor, portal, refunds, disputes. |
NO-CODE.md | Not ready for code? Start charging today with a Payment Link, and know when to switch. |
PRICING.md | A pricing worksheet for small apps, including a margin check for apps with heavy AI usage. |
Every file in the download (paywall-kit-v1.1.zip, 34 files)
paywall-kit/AGENTS-payments.md
paywall-kit/GO-LIVE.md
paywall-kit/LOVABLE-BOLT-SUPABASE.md
paywall-kit/NO-CODE.md
paywall-kit/PRICING.md
paywall-kit/PROMPTS.md
paywall-kit/QUICKSTART.md
paywall-kit/README.md
paywall-kit/TESTING.md
paywall-kit/code/.env.example
paywall-kit/code/app/api/checkout/route.ts
paywall-kit/code/app/api/portal/route.ts
paywall-kit/code/app/api/webhooks/stripe/route.ts
paywall-kit/code/env.example.txt
paywall-kit/code/lib/auth.ts
paywall-kit/code/lib/customers.ts
paywall-kit/code/lib/entitlements.ts
paywall-kit/code/lib/plans.ts
paywall-kit/code/lib/stripe.ts
paywall-kit/code/lib/supabase-admin.ts
paywall-kit/code/lib/upgrade-button.tsx
paywall-kit/code/supabase/config.toml.snippet
paywall-kit/code/supabase/functions/_shared/http.ts
paywall-kit/code/supabase/functions/_shared/plans.ts
paywall-kit/code/supabase/functions/_shared/stripe.ts
paywall-kit/code/supabase/functions/_shared/supabase-admin.ts
paywall-kit/code/supabase/functions/create-checkout-session/index.ts
paywall-kit/code/supabase/functions/customer-portal/index.ts
paywall-kit/code/supabase/functions/env.example.txt
paywall-kit/code/supabase/functions/stripe-webhook/handler.ts
paywall-kit/code/supabase/functions/stripe-webhook/index.ts
paywall-kit/code/supabase/functions/tests/stripe-webhook.test.ts
paywall-kit/code/supabase/migrations/001_billing.sql
paywall-kit/code/supabase/migrations/002_is_pro.sqlUsing Remix, SvelteKit, Express, Rails or Django? The patterns carry over, and the prompts tell your agent to port them to your stack.
Free sample: part of the rules file
This is from AGENTS-payments.md. Paste it into your agent's instructions today, whether or not you buy.
- The webhook is the only writer of paid access. Success pages, redirects,
client callbacks and query strings never grant access.
- Verify every webhook with stripe.webhooks.constructEvent(rawBody, signature,
STRIPE_WEBHOOK_SECRET). Use the raw body; never parse JSON first.
- Idempotency: record event.id before handling; skip duplicates; on failure,
remove the record and return 500 so Stripe retries.
- The client sends a plan key, never a price, amount, quantity or user id.
- Gate on the server. Every Pro-only route, job and AI endpoint checks the
entitlement server-side. UI checks are cosmetic.Paywall Kit
- All 9 guides, the prompts and the rules file
- Next.js reference code, Supabase Edge Functions (for Lovable and Bolt) and SQL migrations
- Use it in your own and your clients' projects
- Instant download after checkout
Secure checkout by Stripe. Your card statement will show the seller's Stripe account name followed by PAYWALL KIT. Not useful? Email aishortlistcheck@gmail.com within 14 days for a full refund.
Who made this
Paywall Kit is made by Isaac Olson, an independent developer. It's a small, focused kit, not a course or a subscription. If something in it is wrong or unclear, email aishortlistcheck@gmail.com and I'll fix it. Buyers get updated versions from the same download page.
Straight answers
Who is this for?
People who built an app with an AI coding tool and want to charge for it, and who'd rather not find out about billing bugs from their customers.
Why not just use Stripe's free agent skills?
You should install them. They're free, made by Stripe, and good at Stripe itself: which API to use, current versions, security settings. Paywall Kit focuses on your app's side of billing: the database tables and row-level security, the one webhook that grants and revokes access, idempotent writes, checking Pro on the server, the Supabase Edge Function gotchas, prompts written for Lovable and Bolt, and a test script and go-live checklist. The two work well together.
Does it work with Lovable, Bolt and Supabase?
Yes. Version 1.1 adds LOVABLE-BOLT-SUPABASE.md and Supabase Edge Functions (Deno) for apps with no server of their own: a verified webhook, checkout and Customer Portal functions, an is_pro() helper for row-level security, and prompts that tell your builder to use the code as-is. It also explains a very common failure: Stripe webhooks getting 401 because the function wasn't deployed with --no-verify-jwt.
Do I need Next.js?
No. There's reference code for Next.js and for Supabase Edge Functions. The rules, prompts, test script and go-live checklist work with any stack.
Has the code been tested?
The Next.js code type-checks against stripe@23 and next@16. The Edge Functions pass deno check, and the included webhook test passes (signatures, re-deliveries, refunds, failures). The SQL was run on Postgres 17. It's reference code, so test it in your own app with Stripe test mode before going live. TESTING.md shows how.
Is this affiliated with Stripe?
No. It's an independent guide. Stripe, Supabase, Next.js, Lovable, Bolt, Claude, Cursor and Codex are trademarks of their owners.
Why does checkout show a different seller name?
Payment is handled through Isaac's Stripe account, so the name at checkout may not say "Paywall Kit". Your card statement ends with PAYWALL KIT.
Is this legal or tax advice?
No. The go-live checklist tells you which questions to answer; it doesn't answer them for you.
What if it's not useful?
Email within 14 days and you'll get a full refund.