// paylab — embedded payments sandbox
Build an invoice, collect a payment, watch the ledger.
Pick a template, make it yours, send it to checkout. The platform retains a 3% fee on settlement — visible to the merchant in the ledger, invisible on the customer's document, exactly as real embedded payments work.
Invoices are stored for 24 hours, then deleted. Please don't enter real customer information — this is a demonstration.
Decisions & trade-offs
The pipeline is deliberately boring — Stripe Checkout, a Redis list, one webhook. The product decisions are where the thinking is, and every one of them is visible in the demo above.
Taking card numbers on your own page maximizes control — and PCI scope. Hosted checkout minimizes both: card data never touches this origin. Scope minimization is a product decision, not an engineering shortcut.
Redirect-based success pages lie: customers close tabs, networks fail. Payment state changes only on signature-verified webhook events (with API reconciliation as the second road to the same truth). Settled-after-they-left is the normal case, not the edge case.
A double-click that double-charges is a trust catastrophe no apology survives. Every charge-creating call carries an idempotency key scoped to the attempt; the ledger is append-only with state derived by folding it, so replayed webhooks are harmless by construction.
The 3% platform fee is shown to the merchant at creation, settlement, and refund. It appears nowhere on the customer's document — fee economics are merchant-platform business, exactly as real Merchant-of-Record products work. Transparency includes knowing who each number is for.
Success UX is easy; what happens on a decline decides whether a customer retries or abandons. Failed attempts land in the ledger with their decline code, the invoice reopens, and a retry gets a genuinely fresh checkout session.
The sandbox banner isn't a disclaimer — it's the product's honesty. Test cards are one click away, the client refuses live keys at boot, and invoices evaporate after 24 hours. Same principle as the document demo's privacy notice: trust needs disclosure, not just architecture.