POST/billing/checkout-session
Create Checkout Session
Website sign-in only
| Field | Type | Description |
|---|---|---|
| url * | string |
curl -X POST 'https://api.papervantage.com/billing/checkout-session' \
-H "Authorization: Bearer $COGNITO_ACCESS_TOKEN"Sections
Overview
API key or sign-in
Billing
Used by the website. These routes don't accept an API key.
POST/billing/portal-session
Create Portal Session
Website sign-in only
| Field | Type | Description |
|---|---|---|
| url * | string |
curl -X POST 'https://api.papervantage.com/billing/portal-session' \
-H "Authorization: Bearer $COGNITO_ACCESS_TOKEN"POST/billing/webhook
Not Cognito-gated -- Stripe calls this directly; the signature is the auth
Public
Every handler is a plain field assignment, so Stripe's at-least-once delivery replaying an event is harmless and needs no idempotency table. Stripe does not deliver in order, so each applied event's `created` time is remembered on the user (stripe_event_at) and an older event is ignored.
Response: any
curl -X POST 'https://api.papervantage.com/billing/webhook'Next: Interests