Setup guide

Everything PaidCheck needs, and exactly why. (The in-app forms generate a real secret and fill it in for you.)

1. Stripe restricted key

Open Stripe Dashboard → Developers → API keys (use the same mode — Live or Test — your app charges in).
Click “Create restricted key”. Choose “Providing this key to another website”, name it PaidCheck.
Set these to Read: Customers, Subscriptions (under Billing), Charges, Events, Webhook Endpoints. Leave EVERYTHING else at None.
Create the key, copy it (starts with rk_live_ or rk_test_) and paste it here. You can roll/delete it in Stripe at any time.

Customers	Read	match a subscription to the customer's email
Subscriptions (Billing)	Read	know who is active, trialing, past_due, unpaid or canceled
Charges	Read	detect duplicate charges
Events	Read	find events whose webhook delivery failed (pending_webhooks > 0)
Webhook Endpoints	Read	detect disabled or missing webhook endpoints
Everything else	None	PaidCheck never writes to Stripe.

2a. Supabase (Lovable, Bolt) — paste into your AI builder

Add a read-only "billing access feed" for PaidCheck to my Supabase project. Do NOT change any existing tables, policies or app behavior.

Create one SQL migration that:
1. Creates schema `paidcheck` (not exposed via the API).
2. Creates view `paidcheck.access_v` with EXACTLY three columns: `email` (lowercased user email, from auth.users), `plan` (text: the plan/tier my app thinks the user is on, or null) and `active` (boolean: true if my app currently gives this user paid access). Look at my schema to find where plan / subscription status / paid access is stored (e.g. profiles.plan, subscriptions.status, profiles.is_pro) and use that. Include every user who has an email.
3. Revokes all privileges on that view from anon, authenticated and public.
4. Creates table `paidcheck.config(secret_hash text not null)`, revokes all privileges on it from anon/authenticated/public, and inserts encode(extensions.digest('<YOUR_PAIDCHECK_SECRET>', 'sha256'), 'hex').
5. Creates function `public.paidcheck_access(secret text) returns table(email text, plan text, active boolean)`, LANGUAGE plpgsql, SECURITY DEFINER, STABLE, `SET search_path = ''`. It must raise an exception (errcode 42501) unless encode(extensions.digest(secret,'sha256'),'hex') matches a row in paidcheck.config, and otherwise `return query select v.email, v.plan, v.active from paidcheck.access_v v`.
6. `revoke all on function public.paidcheck_access(text) from public;` then `grant execute on function public.paidcheck_access(text) to anon;`
Make sure the pgcrypto extension is enabled (schema extensions).

After applying it, test it: calling the RPC with a wrong secret must fail; with the right secret it returns only email, plan, active. Then tell me my Supabase project URL and the anon/publishable key so I can paste them into PaidCheck.

Then give PaidCheck your project URL + anon/publishable key + the secret. The anon key alone can't read anything: the function checks the secret and only returns email/plan/active.

2b. HTTPS endpoint (Next.js, Cursor, any stack)

Add a read-only endpoint for PaidCheck (a billing reconciliation tool). Do NOT change anything else in the app.

Route: GET /api/paidcheck/access
Auth: require the header "Authorization: Bearer <PAIDCHECK_SECRET>". Compare with a constant-time comparison against the env var PAIDCHECK_SECRET. Missing/wrong token → 401 with no body details.
Add PAIDCHECK_SECRET=<YOUR_PAIDCHECK_SECRET> to my environment variables (.env.local and my hosting provider) — never hard-code it.
Response: 200 JSON array, one object per user, with EXACTLY these fields and nothing else:
  [{ "email": "user@example.com", "plan": "pro", "active": true }]
- email: the user's email, lowercased
- plan: the plan/tier my app thinks they're on (string or null)
- active: true if my app currently grants this user paid features, else false
Find where my app stores plan / subscription status / paid access and use exactly the logic my app uses to unlock paid features. Read-only database access only, no writes. Set "Cache-Control: no-store". Must be reachable over HTTPS without any login redirect or bot protection.

When done, tell me the full public URL of the endpoint so I can paste it into PaidCheck.

…or as a Supabase Edge Function

Create a Supabase Edge Function named "paidcheck-access" for PaidCheck (read-only billing reconciliation). Do not change anything else.
- Deploy with verify_jwt = false (it uses its own secret instead).
- Require header "Authorization: Bearer <secret>" and compare in constant time to the function secret PAIDCHECK_SECRET (set it with: supabase secrets set PAIDCHECK_SECRET=<YOUR_PAIDCHECK_SECRET>). Wrong/missing → 401.
- Using the service role client INSIDE the function only, read-only, return a JSON array of { email, plan, active } for every user: email lowercased, plan = the tier my app thinks they're on (or null), active = true if my app grants paid access right now. Use the same logic my app uses to unlock paid features. No other fields.
Tell me the function URL (https://<project>.supabase.co/functions/v1/paidcheck-access) when it's deployed.

Expected format

[{"email":"ana@example.com","plan":"pro","active":true},
 {"email":"bo@example.com","plan":null,"active":false}]