VertoXR Billing Hub

Next.js on Cloudflare • LemonSqueezy Webhooks • RevenueCat Webhooks • Cloud Firestore

System Checking...

🍋

LemonSqueezy (Web)

HMAC SHA-256 Webhooks + Signed Checkout

Web customers check out via LemonSqueezy. Our endpoint embeds the authenticated Firebase Auth user_id and validates HMAC on webhook callbacks to update Firestore.

POST /api/webhooks/lemonsqueezy

📱

RevenueCat (Mobile / XR)

In-App Purchases + Aliasing Transfers

Mobile users purchase via App Store or Google Play. Webhooks auto-sync to Firestore, seamlessly migrating anonymous users to signed-in accounts via TRANSFER events.

POST /api/webhooks/revenuecat

🔥 Firestore Entitlement Engine

All clients read directly from /entitlements/{userId} using real-time listeners. Firestore Security Rules ensure client writes are completely blocked while owners have secure, real-time read access.

// Target Collection: entitlements/{uid}
{
active: true,
tier: "pro",
status: "active",
source: "lemonsqueezy" | "revenuecat",
expiresAt: Timestamp,
cancelAtPeriodEnd: false
}
// Lifecycle & Revocation
Cancellation: Active until expiresAt
Refund: Instant cutoff (active: false)
Transfer: Migrates entitlement to Firebase UID
Idempotency: Replay protection in webhook_events