Missing
Checkout handoffParent checkout can use an external payment entry or a server-created Stripe Checkout Session.
Stripe Setup Center
Payment ops
without secret leaks.
A safe readiness board for the Dungeon Academy paid path: checkout handoff, webhook activation, metadata, parent sessions, and trusted membership records.
Go-live readiness
0/3 core rails
The paid path is ready for real checkout only when checkout handoff, signed parent sessions, and verified webhook activation are all configured.
Missing
Checkout Sessions APIThe server has the Stripe secret key, monthly price ID, and parent session signing needed to create subscription checkout sessions.
Missing
Webhook activationStripe events can create trusted entitlements after signature verification.
Missing
Parent sessionGuardian-scoped checkout and entitlement reads can be tied to signed parent sessions.
Webhook destination
Use this endpoint in Stripe
https://dungeon.games/api/dungeon-academy/membership/stripe/webhook/v1
The webhook route uses the raw body, `stripe-signature`, endpoint signing secret, timestamp tolerance, and Stripe event ID idempotency.
No secret values are rendered on this page or returned by the setup API.
Environment readiness
What is configured right now
Missing
Checkout providerUse Stripe Payment Links or Checkout Sessions, then point the membership checkout flow at the parent-safe checkout entry.
DUNGEON_ACADEMY_CHECKOUT_PROVIDER / DUNGEON_ACADEMY_CHECKOUT_URL
Missing
Webhook signing secretCopy the endpoint signing secret from the Stripe webhook destination into the server environment.
DUNGEON_ACADEMY_STRIPE_WEBHOOK_SECRET / STRIPE_WEBHOOK_SECRET
Missing
Admin activation secretKeep a server-only admin activation path for manual review, comped access, and support corrections.
DUNGEON_ACADEMY_ADMIN_SECRET
Missing
Parent session signingGuardian session signing must be configured before parent-scoped checkout or entitlement reads.
DUNGEON_ACADEMY_SESSION_SECRET / NEXTAUTH_SECRET
Missing
Stripe server keyNeeded when the server creates Stripe Checkout Sessions instead of sending families to an external payment link.
STRIPE_SECRET_KEY / DUNGEON_ACADEMY_STRIPE_SECRET_KEY
Missing
Stripe monthly priceNeeded when the server creates Stripe Checkout Sessions for the monthly Dungeon Academy plan.
DUNGEON_ACADEMY_STRIPE_PRICE_ID / STRIPE_PRICE_ID
Missing
Stripe publishable keyNeeded only if a future parent checkout screen uses Stripe client components.
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY / DUNGEON_ACADEMY_STRIPE_PUBLISHABLE_KEY
Checkout Sessions API
Parent-authenticated Stripe checkout
/api/dungeon-academy/membership/stripe/checkout-session/v1
This endpoint creates a Stripe subscription Checkout Session only after guardian session and policy acceptance. It still returns no paid unlock; the trusted webhook must write the membership record.
Accepted events
Webhook events this build handles
checkout.session.completed
invoice.payment_succeeded
customer.subscription.updated
customer.subscription.deleted
Metadata contract
Fields checkout should carry
parentAccountId
childProfileId
guardianEmail
checkoutIntentId
planId
priceLabel
currentPeriodEnd
Operator path
Turn on billing only after the record path proves itself.
A payment is not enough. The trusted membership record, parent dashboard, and audit trail all have to agree before the paid gate can move beyond the temporary password.
Use the Dungeon Academy monthly plan and keep the displayed school price aligned with the Stripe price.
Set the external checkout URL now, or later wire server-created Checkout Sessions with the Stripe secret key and price ID.
Parent-authenticated checkout can post to /api/dungeon-academy/membership/stripe/checkout-session/v1; it creates a Stripe subscription Checkout Session without granting membership.
Active signed-in members can post to /api/dungeon-academy/membership/stripe/billing-portal/v1; it opens Stripe's customer portal only for the customer ID saved by trusted activation.
For memberships created before customer IDs were stored, post action=attach-stripe-customer to /api/dungeon-academy/membership/admin/v1. It attaches Stripe billing IDs to an existing record only; it does not grant access.
Use https://dungeon.games/api/dungeon-academy/membership/stripe/webhook/v1 and subscribe to the accepted event types listed on this packet.
Checkout events must include parentAccountId, childProfileId, guardianEmail, checkoutIntentId, planId, priceLabel, and currentPeriodEnd where available.
Run a live checkout or Stripe CLI event and confirm the parent dashboard shows an active trusted membership record.