Update: Securing public registration and checkout flows

Yesterday I mentioned preparing for beta testing. Today I focused on securing the entry points and payment flows to ensure a smooth onboarding experience.

Today it's done:

• Public registration opened (removed admin-only restriction)

• Automatic welcome bonus: 50 free credits granted instantly on signup

• Secured Stripe Checkout endpoint (backend-controlled redirect URLs, auth via JWT)

• Added flexible pay-as-you-go credit purchases (custom quantity, min 10 to cover Stripe fees)

Key security and architecture decisions:

• Zero-trust checkout: Client never sends user_id or redirect URLs (prevents open redirect and ID spoofing)

• Role enforcement: Public signup strictly forces role="user" at the backend level

• Configurable onboarding: Welcome bonus amount tied to settings (no hardcoded magic numbers)

Next: Building the frontend Paywall Interceptor (handling 402 responses globally) and the Billing UI.

11 days to launch.