What Is the Paid Community Runbook and What Production Checks Are Needed Before Enabling Payments?

The paid community runbook is a step-by-step guide in docs/paid-community.md for setting up subscription-based payments, requiring webhook validation, database migrations, HTTPS enforcement, rate limiting, and feature flags before going live.

The awesome-gpt-image-2 repository by freestylefly provides a complete implementation for monetizing GPT-powered image communities. This article breaks down the official paid community runbook and the five critical production checks you must complete before accepting real payments.

Understanding the Paid Community Runbook

The runbook lives at docs/paid-community.md and covers the full lifecycle of launching a subscription-based community. It walks through pricing plan configuration, payment gateway integration, and the operational safeguards needed for production deployment.

At its core, the runbook addresses three architectural layers:

• Frontend: Feature-flagged UI components toggled via environment variables
• Backend: Webhook handlers for payment provider events
• Data layer: Supabase migrations for subscription and order state management

Key Configuration Files

File	Purpose
src/supabaseClient.js	Initializes Supabase client for user/subscription data
scripts/alipay-webpay-sandbox-server.mjs	Payment webhook processing (Stripe/Alipay)
src/main.jsx	Feature-flag entry point for payment UI
scripts/generate-site-data.mjs	Staging environment test data generator

Production Checks Before Enabling Payments

According to the runbook, five mandatory checks must pass before flipping the payments switch.

1. Webhook Signature Validation

Payment providers reject unverified webhooks. The runbook requires explicit signature verification in your server-side handler.

In scripts/alipay-webpay-sandbox-server.mjs, the Stripe webhook verification follows this pattern:

import Stripe from 'stripe';

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET;

async function handleWebhook(req, res) {
  const sig = req.headers['stripe-signature'];
  let event;
  
  try {
    event = stripe.webhooks.constructEvent(req.rawBody, sig, endpointSecret);
    // Process successful payment event
    res.status(200).send('OK');
  } catch (err) {
    console.error('Webhook verification failed:', err);
    res.status(400).send(`Webhook Error: ${err.message}`);
  }
}

Critical: Test events must return 200 OK. Any other status causes providers to retry and eventually disable the endpoint.

2. Database Migration Completion

Pending Supabase migrations block production deployment. The runbook specifies that subscription tables must be fully deployed before payments activate.

The Supabase client initialization in src/supabaseClient.js demonstrates the required environment setup:

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = import.meta.env.VITE_SUPABASE_URL;
const supabaseKey = import.meta.env.VITE_SUPABASE_ANON_KEY;

export const supabase = createClient(supabaseUrl, supabaseKey);

3. SSL/TLS Enforcement

Payment providers reject HTTP callbacks. The runbook mandates HTTPS across all payment touchpoints. This is non-negotiable—Stripe and Alipay both refuse to send webhooks to insecure endpoints.

4. Rate Limiting and Monitoring

The runbook requires:

• Rate limits on payment API endpoints to prevent abuse
• Health-check alerts for webhook processing latency
• Error threshold monitoring (zero tolerance for 5xx spikes during payment flows)

5. Feature Flag Protection

The frontend must gate payment features behind an explicit toggle. In src/main.jsx, the implementation uses:

const paymentsEnabled = import.meta.env.VITE_PAYMENTS_ENABLED === 'true';

if (paymentsEnabled) {
  // Render paid-community components (Pricing, Checkout, Subscription Management)
} else {
  // Render free-community view
}

This allows instant rollback without redeployment.

Go-Live Checklist

The runbook concludes with a pre-launch verification table:

Check	Verification Method
All webhooks processed	Review provider dashboard event logs
Zero pending migrations	supabase db status returns clean
Monitoring dashboards	No error spikes in last 24 hours
Environment documentation	Live keys replace sandbox credentials in .env.production
Staging end-to-end test	Complete purchase flow with test cards succeeds

Testing Procedure

Before production, deploy to staging and execute:

1. Generate test site data via scripts/generate-site-data.mjs
2. Run full payment flow with sandbox credentials
3. Verify order creation, receipt generation, and subscription status updates in Supabase
4. Confirm webhook delivery and signature validation logs

Summary

The paid community runbook in docs/paid-community.md provides the operational framework for monetizing GPT image communities. Before enabling payments, complete these five production checks:

• Webhook signature validation with 200 OK responses
• Database migrations fully deployed to Supabase
• HTTPS enforcement across all payment endpoints
• Rate limiting and monitoring with configured alerts
• Feature flag protection for instant rollback capability

These safeguards, as implemented in awesome-gpt-image-2, prevent revenue loss from failed payments and maintain trust with subscribers.

Frequently Asked Questions

What file contains the complete paid community runbook?

The full documentation is located at docs/paid-community.md in the repository root. It includes pricing setup, payment provider configuration, and the production go-live checklist.

How does the repository handle payment provider webhooks?

Webhook processing is implemented in scripts/alipay-webpay-sandbox-server.mjs using Stripe's official SDK with explicit signature verification. The handler validates the stripe-signature header and returns 200 OK only after successful verification.

What happens if I enable payments without completing the production checks?

The runbook warns that skipping checks results in failed webhook deliveries, lost subscription state, rejected callbacks over HTTP, or unmonitored payment API failures. Any of these errors cause revenue leakage and provider account suspension.

Can I test payments before going live?

Yes. The runbook specifies a staging deployment using scripts/generate-site-data.mjs for test data and sandbox credentials for the full purchase flow. This validates order creation, receipts, and subscription updates without real money movement.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}