Stripe
Billing
Checkout, customer portal, and webhook routes are intentionally backend owned behind API Gateway and Lambda.
Current plan
Billing state should be projected from Stripe webhooks into DynamoDB.
starter
Entitlement source
The app should trust your own projection, not Stripe on every request.
Cognito authenticates the user, API Gateway authorizes the request, and Lambda checks workspace membership plus plan state.