How to Add Payments to an AI App: Checkout, Webhooks and the SDK

To add payments to an AI app, your server creates a checkout session for the signed-in user, the user pays on a hosted or embedded checkout, and a signed webhook tells your app to unlock the plan or the credits. With Pocketsflow that is one SDK call, one script tag and one webhook endpoint, and Pocketsflow acts as the merchant of record, so sales tax and VAT are handled on every payment.

Pick a billing model for your AI app

Pocketsflow supports the three models most AI apps use, and you can mix them.

• Subscription: a monthly or yearly plan with an optional free trial. Your app enforces the plan's limits.
• Prepaid credits: the buyer pays for a balance, and your backend deducts each generation with POST /credits/deduct. Buyers can opt in to auto-refill. Credits work on every Pocketsflow plan.
• Usage meters: a subscription with included usage, and Pocketsflow bills the overage at the end of each period. Meters need the Pocketsflow Pro plan. See usage-based billing for SaaS.

How to add payments to an AI app with Pocketsflow, step by step

1. Create a test API key. In the Pocketsflow dashboard, open Developers, then API keys, and create a pk_test_ key. The key decides the mode: a test key only reads and writes test data and never charges a real card. Keep it on your server.
2. Create what you sell. Create a subscription offer or a Credits product in the dashboard, or with the SDK's subscriptionOffers.create. Set a store subdomain and publish the product: a checkout session needs both.
3. Install the SDK. Run npm install pocketsflow in your backend. The SDK is for server code only, never the browser.
4. Create a checkout session. When a signed-in user clicks Upgrade, call checkout.create (the SDK's wrapper for POST /checkout/sessions) with the product id and the user's id in metadata.
5. Show the checkout. Redirect to the session's url, or open it in an overlay with Pocketsflow's embed.js.
6. Grant access from a webhook. Register an endpoint for order.completed, customer.subscription.created, customer.subscription.deleted and invoice.payment_failed. Verify the signature, read your user id from metadata, and update the user's plan.
7. Go live. Repeat with a pk_live_ key and a live webhook endpoint. A test endpoint only receives test events.

Create a checkout session with the Pocketsflow SDK

The official pocketsflow npm package wraps the REST API. This is the checkout example from the Pocketsflow SDK docs, with the user's id added to metadata:

import { Pocketsflow } from "pocketsflow";

const pocketsflow = new Pocketsflow({
  apiKey: process.env.POCKETSFLOW_API_KEY!, // pk_test_... while you build
});

// In your server route, for the signed-in user:
const session = await pocketsflow.checkout.create({
  productId: offer._id, // a product or a subscription offer
  successUrl: "https://example.com/welcome",
  cancelUrl: "https://example.com/pricing",
  customerEmail: user.email,
  metadata: { userId: user.id },
});

// Redirect the buyer to session.url.

productId takes a one-time product or a subscription offer, so the same call sells a plan or a credit pack. In the SDK, successUrl and cancelUrl are required. For a subscription, Pocketsflow replays your metadata on every subscription and invoice webhook, so each renewal and cancellation names the user. Card, Apple Pay, Google Pay and local methods come from your Pocketsflow account; there is no payment method parameter.

Embedded checkout or a redirect on Pocketsflow

Pocketsflow's checkout can open on its own page or on top of yours. To embed it, add embed.js once and call Pocketsflow.open(session.url) on the Upgrade click. The buyer pays in an overlay and stays inside your AI app. On screens narrower than 560px the checkout opens in a new tab instead. Apple Pay and Google Pay in the overlay need your domain verified under Settings, then Checkout. A redirect is simpler and works everywhere; the overlay keeps the user in the flow of a chat or an editor. More on the checkout itself is on the checkout page overview.

Grant access from Pocketsflow webhooks, not the browser

The overlay fires a pocketsflow:success event in the page, but Pocketsflow's docs are clear that it is a signal for the page, not proof of payment. Unlock features from the signed webhook only.

• Verify X-Pocketsflow-Signature-V2: an HMAC-SHA256 of the timestamp and the raw body, keyed with the endpoint's secret. Hash the raw bytes before you parse the JSON.
• Drop repeats by X-Pocketsflow-Event-Id. Retries carry the same id.
• Answer with a 2xx within 15 seconds and do slow work in a queue.
• On customer.subscription.created grant the plan, on customer.subscription.deleted remove it, and on order.completed fulfil a one-time purchase.
• For credits, credit.granted and credit.balance_changed keep your copy of the balance in step.

What the Pocketsflow fee is on small AI app payments

Selling on Pocketsflow has no monthly fee. Each payment carries the Pocketsflow fee, 4.7% + $0.30 as of November 2026. Because part of the fee is fixed, small payments pay a larger share, which matters for AI apps that sell small credit packs.

On a $5.00 credit pack the fee is $0.54, or 10.8% of the payment. On $20.00 it is $1.24, or 6.2%, and on $100.00 it is 5%. If most buyers top up often, a larger minimum pack or auto-refill at a larger amount keeps more of each dollar.

When another payment setup fits an AI app better

If your AI app is a native iOS or Android app selling digital features, the app stores' own billing rules may apply, so check them first. If you already run Stripe Billing and file sales tax in every country yourself, staying there can be simpler than a move. Pocketsflow fits when you want one checkout for plans and credits, webhooks to grant access, and tax handled as the merchant of record.

Where to go next

Selling an API to developers? Read how to sell API access. Wondering whether your code or an AI assistant should call Pocketsflow? Read MCP vs API for selling online. Then see Pocketsflow credits, the developers page and the pricing page.