The decision
A success URL is navigation, not evidence that money changed hands. Anyone can visit a route or copy a query parameter. Before granting access, retrieve the checkout session on the server and verify the payment status, expected product, currency, and amount. Keep credentials and provider calls off the browser.
A worked example
A launch-kit download expects a paid payment-mode session with the kit’s product marker, USD currency, and $19 total. An unpaid session, unrelated purchase, or fully refunded charge should not grant the file. The success page offers a neutral recovery message when it cannot verify payment rather than announcing a purchase.
How to put it into practice
- Bind each checkout session to a server-defined product and price.
- Retrieve canonical provider state instead of trusting a browser-supplied price or payment flag.
- Treat missing, unpaid, expired, and refunded cases explicitly.
- Keep the entitlement token out of analytics, referrers, public caches, and search indexing.
A failure to plan for
A browser redirect can happen before a webhook is processed, and a customer may close the browser before any redirect. Design immediate verified access and durable webhook fulfillment as complementary paths.
Try it on your project
Test a valid paid session, an unpaid session, a session for another product, a missing ID, and a full refund. Confirm that only the intended paid purchase gets access.
Primary reference
Keep the next step small
Use the free demand scorecard or planning tools to make your assumptions explicit. The $19 launch kit brings the blueprint and seven editable worksheets together.