Tested by SkillHammer Agent Skill, project doctor and drop-in Supabase webhook code

Paid-But-Locked Fix (Stripe + Supabase)

Fix “I paid but nothing happened” on Supabase: find the cause in 2 minutes, drop in a tested webhook.

"I paid but nothing happened" is the most expensive support email a small SaaS gets. With Supabase it is usually verify_jwt left on (Stripe gets a 401 and your logs show nothing), constructEvent() throwing in Deno, a parsed body, the wrong whsec_, or an event that arrived before checkout linked the user.

The doctor (node tools/doctor.mjs, read-only, no dependencies) scans your project for 9 causes, including a service-role key in browser code and a billing RPC any signed-in user can call to unlock themselves.

The fix: a Supabase migration (RLS tables, a billing_access view and one atomic stripe_apply_event function), an Edge Function using constructEventAsync, a Next.js route alternative, and a success-page snippet that waits for the webhook.

What's in the download

• tools/doctor.mjs: read-only project scanner (9 rules)
• supabase/migrations/…_stripe_billing.sql, supabase/functions/stripe-webhook/, supabase/config.toml.snippet
• nextjs/ route alternative and snippets/wait-for-access.ts
• SKILL.md, README.md, tests/, TEST-REPORT.md, LICENSE.txt, REFUND.txt

Who it's for

Founders and developers selling subscriptions or one-time access with Stripe Checkout on a Supabase app (Edge Functions or Next.js).

What's tested

• 26/26 tests: 21 Deno tests (webhook, SQL, snippets, Next.js adapter) and 5 doctor tests, plus doctor exit codes on good and bad fixtures
• The migration runs on a real Postgres engine (PGlite) with Supabase-like roles, using the real stripe and supabase-js npm SDKs
• Mutation check: 10 deliberate bugs injected into the code, 10/10 caught by the tests

What isn't tested

• A live Supabase project (real gateway, supabase functions deploy, the real verify_jwt behaviour); PostgREST is a small local stand-in
• A live Stripe account or stripe listen: events are hand-built JSON in Stripe's format
• A real Next.js build or the Vercel Edge runtime

Read the full TEST-REPORT

Requirements

A Supabase project and Stripe account. Node 18+ for the doctor. Deno 2.x and Node to run the bundled tests.

How to use it

Run node tools/doctor.mjs /path/to/your/app, then apply the migration, deploy the Edge Function with verify_jwt = false, and follow README.md.