API design patterns, communication protocols, payments, and authentication.
Checkout is the demo. Production is webhooks, idempotent sync, dunning, and the test-to-live checklist — the Stripe setup that keeps working after launch.
An unverified Stripe webhook lets anyone grant themselves your product for free. How signing works, the raw-body rule, and idempotency in Next.js routes.
The NextAuth v5 mental model, OAuth before passwords, bcrypt done right, JWT versus database sessions, and the security work the library leaves to you.
