# What Is the Paid Community Runbook and What Production Checks Are Needed Before Enabling Payments?

> Learn about the paid community runbook and essential production checks for enabling payments. Discover webhook validation, HTTPS enforcement, rate limiting, and more for a secure launch.

- Repository: [苍何/awesome-gpt-image-2](https://github.com/freestylefly/awesome-gpt-image-2)
- Tags: how-to-guide
- Published: 2026-09-02

---

**The paid community runbook is a step-by-step guide in [`docs/paid-community.md`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/docs/paid-community.md) for setting up subscription-based payments, requiring webhook validation, database migrations, HTTPS enforcement, rate limiting, and feature flags before going live.**

The `awesome-gpt-image-2` repository by freestylefly provides a complete implementation for monetizing GPT-powered image communities. This article breaks down the official paid community runbook and the five critical production checks you must complete before accepting real payments.

## Understanding the Paid Community Runbook

The runbook lives at **[`docs/paid-community.md`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/docs/paid-community.md)** and covers the full lifecycle of launching a subscription-based community. It walks through pricing plan configuration, payment gateway integration, and the operational safeguards needed for production deployment.

At its core, the runbook addresses three architectural layers:

- **Frontend**: Feature-flagged UI components toggled via environment variables
- **Backend**: Webhook handlers for payment provider events
- **Data layer**: Supabase migrations for subscription and order state management

### Key Configuration Files

| File | Purpose |
|------|---------|
| [`src/supabaseClient.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/src/supabaseClient.js) | Initializes Supabase client for user/subscription data |
| `scripts/alipay-webpay-sandbox-server.mjs` | Payment webhook processing (Stripe/Alipay) |
| [`src/main.jsx`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/src/main.jsx) | Feature-flag entry point for payment UI |
| `scripts/generate-site-data.mjs` | Staging environment test data generator |

## Production Checks Before Enabling Payments

According to the runbook, five mandatory checks must pass before flipping the payments switch.

### 1. Webhook Signature Validation

Payment providers reject unverified webhooks. The runbook requires explicit signature verification in your server-side handler.

In `scripts/alipay-webpay-sandbox-server.mjs`, the Stripe webhook verification follows this pattern:

```javascript
import Stripe from 'stripe';

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET;

async function handleWebhook(req, res) {
  const sig = req.headers['stripe-signature'];
  let event;
  
  try {
    event = stripe.webhooks.constructEvent(req.rawBody, sig, endpointSecret);
    // Process successful payment event
    res.status(200).send('OK');
  } catch (err) {
    console.error('Webhook verification failed:', err);
    res.status(400).send(`Webhook Error: ${err.message}`);
  }
}

```

**Critical:** Test events must return `200 OK`. Any other status causes providers to retry and eventually disable the endpoint.

### 2. Database Migration Completion

Pending Supabase migrations block production deployment. The runbook specifies that subscription tables must be fully deployed before payments activate.

The Supabase client initialization in [`src/supabaseClient.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/src/supabaseClient.js) demonstrates the required environment setup:

```javascript
import { createClient } from '@supabase/supabase-js';

const supabaseUrl = import.meta.env.VITE_SUPABASE_URL;
const supabaseKey = import.meta.env.VITE_SUPABASE_ANON_KEY;

export const supabase = createClient(supabaseUrl, supabaseKey);

```

### 3. SSL/TLS Enforcement

Payment providers reject HTTP callbacks. The runbook mandates HTTPS across all payment touchpoints. This is non-negotiable—Stripe and Alipay both refuse to send webhooks to insecure endpoints.

### 4. Rate Limiting and Monitoring

The runbook requires:

- Rate limits on payment API endpoints to prevent abuse
- Health-check alerts for webhook processing latency
- Error threshold monitoring (zero tolerance for 5xx spikes during payment flows)

### 5. Feature Flag Protection

The frontend must gate payment features behind an explicit toggle. In [`src/main.jsx`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/src/main.jsx), the implementation uses:

```javascript
const paymentsEnabled = import.meta.env.VITE_PAYMENTS_ENABLED === 'true';

if (paymentsEnabled) {
  // Render paid-community components (Pricing, Checkout, Subscription Management)
} else {
  // Render free-community view
}

```

This allows instant rollback without redeployment.

## Go-Live Checklist

The runbook concludes with a pre-launch verification table:

| Check | Verification Method |
|-------|---------------------|
| All webhooks processed | Review provider dashboard event logs |
| Zero pending migrations | `supabase db status` returns clean |
| Monitoring dashboards | No error spikes in last 24 hours |
| Environment documentation | Live keys replace sandbox credentials in `.env.production` |
| Staging end-to-end test | Complete purchase flow with test cards succeeds |

## Testing Procedure

Before production, deploy to staging and execute:

1. Generate test site data via `scripts/generate-site-data.mjs`
2. Run full payment flow with sandbox credentials
3. Verify order creation, receipt generation, and subscription status updates in Supabase
4. Confirm webhook delivery and signature validation logs

## Summary

The **paid community runbook** in [`docs/paid-community.md`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/docs/paid-community.md) provides the operational framework for monetizing GPT image communities. Before enabling payments, complete these five **production checks**:

- **Webhook signature validation** with 200 OK responses
- **Database migrations** fully deployed to Supabase
- **HTTPS enforcement** across all payment endpoints
- **Rate limiting and monitoring** with configured alerts
- **Feature flag protection** for instant rollback capability

These safeguards, as implemented in `awesome-gpt-image-2`, prevent revenue loss from failed payments and maintain trust with subscribers.

## Frequently Asked Questions

### What file contains the complete paid community runbook?

The full documentation is located at **[`docs/paid-community.md`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/docs/paid-community.md)** in the repository root. It includes pricing setup, payment provider configuration, and the production go-live checklist.

### How does the repository handle payment provider webhooks?

Webhook processing is implemented in `scripts/alipay-webpay-sandbox-server.mjs` using Stripe's official SDK with explicit signature verification. The handler validates the `stripe-signature` header and returns 200 OK only after successful verification.

### What happens if I enable payments without completing the production checks?

The runbook warns that skipping checks results in failed webhook deliveries, lost subscription state, rejected callbacks over HTTP, or unmonitored payment API failures. Any of these errors cause revenue leakage and provider account suspension.

### Can I test payments before going live?

Yes. The runbook specifies a staging deployment using `scripts/generate-site-data.mjs` for test data and sandbox credentials for the full purchase flow. This validates order creation, receipts, and subscription updates without real money movement.