All packsSaaS Billing + Tax CoreSolve
stripe checkout session duplicate subscription prevent double billing
Stopping a second live subscription before it starts
Two tabs, two checkout sessions, one account -- without a guard the second one creates a second live subscription and double-bills. The pack returns 409 first (D13).
This is one of the things SaaS Billing + Tax Core already handles. Charge per-seat subscriptions: upgrades, downgrades, failed cards, invoices and sales tax.
Is this you?
A double-submit -- the same customer opening checkout in two tabs, or clicking buy twice before the page updates -- can create two separate live Stripe subscriptions for one account if nothing stops it. Two live subscriptions on one account means double billing, and unwinding it after the fact means refunds and an awkward support conversation.
Why this one is easy to get wrong
Hosted Stripe Checkout makes starting a subscription so simple (redirect to a session, Stripe handles the form) that it's easy to treat "can this account start a checkout" as a question Stripe itself answers, when in fact Stripe is happy to create a second subscription for an account that already has one live -- the guard has to live in the app, before the redirect.
What you get instead
D13 has the checkout route return 409 whenever the account already has a live subscription (ACTIVE, PAST_DUE, or UNPAID), checked against the webhook-maintained cache. It's explicitly documented as best-effort -- a narrow race window exists during the very first checkout's completion -- which is exactly why D12's idempotency keys and D5's supersession rules exist as the second and third layers of the same defense, not a single silver-bullet check.
Source: ARCHITECTURE.md D13 — checkable in the pack you receive
How you actually use this
You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.
Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.
Typical build: about 18 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.
Why you can believe this
3 of 3 runs passedWe ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →