21–30 of 43 posts
What's stopping me from opening the console and calling the "addMoreCredits" function? Why can't I just edit the code to remove any mention of consuming credits?
I think you're about to discover why most multiplayer games have moved authoritative simulation to the server.
I find everything about web technology nowadays to be extremely obtuse. I am mostly an embedded/Linux driver engineer, but I think I know the basics of HTTP, REST APIs, Docker containers, how the web works overall etc. But, like. What are we doing? What do you mean make the billing backendless? Obviously there has to be a backend to process the payment. What are you even saying? You are presumably not building a dist…
You should look deeper into JWTs and what you can do with them. Sounds like you are on the way to reinventing them.
Yes! This is exactly what we're doing now which also helps us be a little more framework agnostic. Nextjs kind of just lets us have them built-in
> Server actions are public, unauthenticated routes Why can't they be authenticated? That seems like the obvious fix. Otherwise how you are handing out the correct customer_id unless you authenticate somehow? This scheme also complicates API key rotation, although you can work around it by trying to decrypt with both the old and new key if you use e.g. authenticated encryption. This also has no mechanism for expirati…
Maybe we didn't phrase it as well as we should've. We meant to say API routes in general are public, and so the server actions could be called by anyone. Authentication is definitely possible, but we were trying to brainstorm a way where users could have protected routes with as little set up as possible, the ideal being they just pass in customerId into a Provider component We also did think about things like regist…
Your encrypted customer ID has the exact same semantics as the original customer ID for an attacker, and is insecure.
If you don't have a backend, how do you make sure I'm billed? What's stopping me from opening the console and calling the "addMoreCredits" function? Why can't I just edit the code to remove any mention of consuming credits? I think you're about to discover why most multiplayer games have moved authoritative simulation to the server.
I'm rather confused by this article - I've made products and pricing services, and just on the first line its said that billing requires webhooks and state syncing.. but why? Is it a way to utilize payments in an otherwise static site? Whats the benefit? You can absolutely accept payments without webhooks. Please help, I really don't understand the niche! I'm left with the sense that this is a sort of solution that's…
Yes you're right -- payments can definitely be done without webhooks, but it is typically all controlled server-side. Especially things like upgrade and downgrade flows, as they involve automatically charging a user's card. What we were exploring is whether there's a way to do this securely from the frontend (eg on a pricing page) without needing to open up backend routes. You're also correct that our niche is trying…
This will not give you clean easy to understand reporting if you make bundles willy-nilly (N product line makes $ dollars, if bundled products exist), but to me, it gives accurate data that matches up with the pricing complexity that the business is designing.
Aren’t server actions a backend?
I'm rather confused by this article - I've made products and pricing services, and just on the first line its said that billing requires webhooks and state syncing.. but why? Is it a way to utilize payments in an otherwise static site? Whats the benefit? You can absolutely accept payments without webhooks. Please help, I really don't understand the niche! I'm left with the sense that this is a sort of solution that's…
Technically speaking, billing and payments are two separate things.
For example: OpenAI needs to calculate how much you need to pay for the tokens you consumed across all of its models. That usage aggregation, calculation and then issuing of an invoice is billing—payments is only the transfer of money.
I find everything about web technology nowadays to be extremely obtuse. I am mostly an embedded/Linux driver engineer, but I think I know the basics of HTTP, REST APIs, Docker containers, how the web works overall etc. But, like. What are we doing? What do you mean make the billing backendless? Obviously there has to be a backend to process the payment. What are you even saying? You are presumably not building a dist…
I believe the marketing material around serverles functions is at fault. Clearly there is a server, because there is a computer answering requests on a specific ip address mapped to dns. So the wording is maddening. It’s a bit like cgi-bin except it spins up a vm or other sandbox to run the serving code instead of just starting a process.
This is just billing as a service.