Engineering Reference

SaaS Billing Architecture & Payments Guide

Production-grade architectural patterns for subscription billing, webhook processing, and checkout flows — idempotency, FSM state machines, outbox pattern, double-entry ledger, and PCI-compliant design for engineers who build revenue-critical systems.

Built for fintech engineers and SaaS founders

Modern SaaS revenue stacks are not just payment integrations — they are distributed systems with strict consistency, idempotency, and compliance requirements. This site documents the architectural decisions, failure modes, and production patterns that separate reliable billing engines from fragile ones.

Every guide covers SQL schemas, Python backend logic, TypeScript handler patterns, and YAML config examples drawn from real production architectures. Topics span from proration calculations and dunning retry matrices to HMAC webhook verification and double-entry ledger design.

Whether you are integrating a payment provider for the first time or hardening a multi-tenant billing engine, the patterns here are concrete, codified, and compliance-ready.

💳

Subscription Billing Architecture

FSM-driven subscription lifecycles, versioned price books, proration engines, usage-based metering pipelines, trial period management, and hybrid pricing model databases.

Explore section →
🛒

Frontend Checkout & Dunning

Stripe Elements integration with React, secure card vaulting, PCI-compliant hosted fields, dunning retry schedules, smart decline routing, and customer portal self-service flows.

Explore section →
🔔

Webhook Processing & State Management

HMAC-SHA256 signature verification, idempotent event handlers, outbox pattern, out-of-order delivery resolution, database sync consistency, and microservice state propagation.

Explore section →

Core Architectural Patterns

🔑

Idempotency

Idempotency keys + Redis/DB unique constraints for exactly-once billing event processing.

⚙️

FSM State Machines

Strict transitions: draft → active → past_due → canceled with version-column optimistic locking.

📤

Outbox Pattern

Write business data + event to DB atomically; background worker dispatches to broker for exactly-once delivery.

📒

Double-Entry Ledger

Every debit has a matching credit. Store amounts in cents. Assert SUM == 0 per transaction.

🔒

Webhook Security

HMAC-SHA256 signature verification before any business logic. Reject timestamp drift > 5 min.

🛡️

PCI / GDPR

Never persist raw PANs. AES-256-GCM field encryption for PII. 7-year immutable audit log.