Build Revenue-Generating Apps with Antigravity — From Stripe Integration to Store Launch & Monthly Revenue

STRIPE_SECRET_KEY=YOUR_STRIPE_SECRET_KEY
STRIPE_PUBLISHABLE_KEY=YOUR_STRIPE_PUBLISHABLE_KEY
STRIPE_WEBHOOK_SECRET=YOUR_STRIPE_WEBHOOK_SECRET

// server/stripe-setup.ts
import Stripe from 'stripe';
 
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
 
async function setupStripeProducts() {
  const productStandard = await stripe.products.create({ name: 'Standard Plan', type: 'service' });
  const productPremium = await stripe.products.create({ name: 'Premium Plan', type: 'service' });
 
  await stripe.prices.create({
    product: productStandard.id,
    unit_amount: 399, // $3.99 (in cents)
    currency: 'usd',
    recurring: { interval: 'month', interval_count: 1 },
  });
 
  await stripe.prices.create({
    product: productPremium.id,
    unit_amount: 799,
    currency: 'usd',
    recurring: { interval: 'month', interval_count: 1 },
  });
 
  console.log('Stripe products and prices created.');
}
 
setupStripeProducts().catch(console.error);

// server/routes/subscription.ts
import express from 'express';
import Stripe from 'stripe';
import { authenticateUser } from './middleware/auth';
 
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
const router = express.Router();
 
router.post('/create-subscription-session', authenticateUser, async (req, res) => {
  const { userId } = req.user;
  const { priceId } = req.body;
 
  try {
    let customerId: string;
    const user = await db.getUser(userId);
 
    if (user.stripeCustomerId) {
      customerId = user.stripeCustomerId;
    } else {
      const customer = await stripe.customers.create({ email: user.email, metadata: { userId } });
      customerId = customer.id;
      await db.updateUser(userId, { stripeCustomerId: customerId });
    }
 
    const session = await stripe.checkout.sessions.create({
      mode: 'subscription',
      customer: customerId,
      line_items: [{ price: priceId, quantity: 1 }],
      success_url: `${process.env.APP_URL}/success?session_id={CHECKOUT_SESSION_ID}`,
      cancel_url: `${process.env.APP_URL}/pricing`,
    });
 
    res.json({ sessionId: session.id });
  } catch (error) {
    res.status(500).json({ error: (error as Error).message });
  }
});
 
export default router;

// server/routes/webhook.ts
import Stripe from 'stripe';
 
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
 
router.post('/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
  const sig = req.headers['stripe-signature'] as string;
  let event: Stripe.Event;
 
  // 1. Verify signature — reject forged requests
  try {
    event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET!);
  } catch (err) {
    return res.status(400).send(`Webhook signature error: ${(err as Error).message}`);
  }
 
  // 2. Idempotency — never confirm the same event twice
  if (await db.hasProcessedEvent(event.id)) {
    return res.json({ received: true, duplicate: true });
  }
 
  try {
    switch (event.type) {
      case 'checkout.session.completed': {
        const session = event.data.object as Stripe.Checkout.Session;
        const userId = session.metadata?.userId;
        if (userId) await db.updateUser(userId, { plan: 'premium', status: 'active' });
        break;
      }
      case 'customer.subscription.deleted': {
        const sub = event.data.object as Stripe.Subscription;
        const userId = sub.metadata?.userId;
        if (userId) await db.updateUser(userId, { plan: 'free', status: 'canceled' });
        break;
      }
    }
 
    // 3. Mark processed, then return 200
    await db.markEventProcessed(event.id);
    res.json({ received: true });
  } catch (error) {
    // 4. On failure return 500 so Stripe retries (and do NOT record it)
    res.status(500).json({ error: (error as Error).message });
  }
});

// client/ios/StoreKitPurchase.swift
import StoreKit
 
func purchasePremiumPlan() {
  Task {
    do {
      let entitlements = try await AppStore.sync()
      if entitlements.contains(where: { $0.productID == "premium_monthly" }) {
        await notifyBackendOfPurchase(productId: "premium_monthly")
      }
    } catch {
      print("Purchase failed: \(error)")
    }
  }
}

// client/android/GooglePlayIAP.java
billingClient = BillingClient.newBuilder(context)
    .setListener(purchasesUpdatedListener)
    .enablePendingPurchases()
    .build();
 
// On purchase completion, send purchaseToken to the backend and verify server-side
PurchasesUpdatedListener purchasesUpdatedListener = (result, purchases) -> {
  if (result.getResponseCode() == BillingClient.BillingResponseCode.OK && purchases != null) {
    for (Purchase purchase : purchases) {
      verifyPurchaseWithBackend(purchase.getPurchaseToken());
    }
  }
};

// server/routes/verify-iap.ts
router.post('/verify-google-play-iap', async (req, res) => {
  const { purchaseToken, userId, productId } = req.body;
  try {
    const response = await axios.get(
      `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${process.env.PACKAGE_NAME}/subscriptions/${productId}/tokens/${purchaseToken}`,
      { headers: { Authorization: `Bearer ${process.env.GOOGLE_PLAY_API_TOKEN}` } }
    );
    if (response.data.purchaseState === 0) { // PURCHASED
      await db.updateUser(userId, {
        plan: productId.includes('premium') ? 'premium' : 'standard',
        source: 'google_play',
        iapPurchaseToken: purchaseToken,
      });
      res.json({ success: true });
    } else {
      res.status(400).json({ error: 'Invalid purchase state' });
    }
  } catch (error) {
    res.status(500).json({ error: (error as Error).message });
  }
});

// server/lib/entitlement.ts
type Source = 'stripe' | 'app_store' | 'google_play';
 
// User is premium if at least one path grants it
async function recomputeEntitlement(userId: string) {
  const grants = await db.getActiveGrants(userId); // active records per source
  const isPremium = grants.some((g) => g.plan === 'premium' && g.status === 'active');
  await db.updateUser(userId, { plan: isPremium ? 'premium' : 'free' });
}
 
// A cancellation on one source expires only that source's grant
async function revokeGrant(userId: string, source: Source) {
  await db.expireGrant(userId, source);
  await recomputeEntitlement(userId);
}

// server/routes/portal.ts
router.post('/create-portal-session', authenticateUser, async (req, res) => {
  const user = await db.getUser(req.user.userId);
  const session = await stripe.billingPortal.sessions.create({
    customer: user.stripeCustomerId,
    return_url: `${process.env.APP_URL}/account`,
  });
  res.json({ url: session.url });
});