Your AI built the checkout.
Who's checking it actually works?
PaidCheck compares Stripe with who really has access in your app — every night — and emails you the moment a paying user is locked out, a cancelled user is still in, or a webhook silently fails.
Read-only keys only · 2-minute setup · No code changes beyond one copy-paste prompt
What PaidCheck catches
AI-generated billing code usually works on the happy path. The leaks are in the edges: retries, cancellations, card failures and webhooks nobody is watching.
💸 Paying, but locked out
A customer paid in Stripe, but your app never flipped them to Pro — usually a webhook that 400'd or a mismatched email. These turn into refunds, 1-star reviews and $15 dispute fees.
🚪 Cancelled, still inside
Subscription is canceled, past_due or unpaid in Stripe, but the user still has paid access in your database. Free product, forever, quietly.
🔁 Double charges
Same customer, same amount, minutes apart — the classic double-click on checkout without idempotency. Refund before they dispute.
📭 Failed webhooks
Events your endpoint never acknowledged (pending_webhooks > 0) and endpoints Stripe has disabled. The root cause of most of the above.
Every report shows revenue at risk — recurring dollars per month plus one-time exposure — and the exact fix for each issue.
How it works
Two read-only connections. No SDK, no code in your checkout path.
1 · Stripe restricted key
Create a key with Read on 5 resources and None on everything else. Takes a minute; you can revoke it anytime.
2 · One access source
Paste our prompt into Lovable/Cursor. It adds either a secret-protected Supabase function or a bearer-protected endpoint that returns only email, plan, active.
3 · Reconcile
We match subscriptions to users by email and flag every mismatch, double charge and webhook failure, ranked by dollars at risk.
4 · Get alerted
Paid plans run on a schedule, email you instantly when something new breaks, and send a Monday summary.
Pricing
One recovered subscription usually pays for a year.
Leak report
One-time, on demand.
- Full reconciliation of one app
- Revenue-at-risk number
- Fix instructions for each issue
- Keys used once, never stored
Solo
For your one money-making app.
- 1 app
- Nightly checks
- Instant alert emails for new leaks
- Monday summary email
Multi-app
For serial shippers.
- Up to 5 apps
- Hourly checks
- Instant alerts + Monday summary
- Comp/teammate allowlist
Security: read-only by design
We built PaidCheck the way we'd want a tool touching our own Stripe to work.
We refuse full secret keys
Only Stripe restricted keys (rk_…) are accepted. sk_live_ keys are rejected outright. Your key can read, never refund, charge or change anything.
Minimum data from your app
Your access source exposes exactly three fields — email, plan, active — behind a secret. No passwords, no profile data, no service-role keys (we reject those too).
Encrypted at rest
Keys for monitored apps are encrypted with AES-256-GCM before storage; the encryption key lives only in server environment variables. Delete an app and its keys are gone.
Free report stores nothing
The free leak report uses your keys for one request, shows the results in your browser, and keeps nothing — no keys, no customer list.
Exact Stripe permissions
| Customers | Read | match a subscription to the customer's email |
| Subscriptions (Billing) | Read | know who is active, trialing, past_due, unpaid or canceled |
| Charges | Read | detect duplicate charges |
| Events | Read | find events whose webhook delivery failed (pending_webhooks > 0) |
| Webhook Endpoints | Read | detect disabled or missing webhook endpoints |
| Everything else | None | We never write to Stripe. |
Find out in 2 minutes if you're leaking money
Free, one-time, nothing stored.
Run a free leak report →