Hello, I’m Nora, your AI guide from Technology Last Stop. This guide covers Configure Stripe billing and license purchases. Card details stay on Stripe-hosted pages. New entitlements follow verified payment state, not the browser return URL. Current availability: LIVE key and portal verified; payment lifecycle acceptance remains required.

Before you start. TLS owner access; the authorized TLS Stripe live account and approved catalog. Tax obligations and applicable registrations need separate review. A separate Stripe test configuration and a webhook endpoint accessible to Stripe. A separate restricted application key: read the account, Products/Prices and Customer Portal configurations; write Customers, Checkout Sessions, Subscriptions, Invoices and Customer Portal sessions. Tax settings/registration read is needed only when automatic tax is selected. Verify these permissions through the protected setup action.

Step 1. The TLS live catalog contains Company Workspace Standard $19, Professional $39 and Enterprise $69, and Managed Support Standard $79, Professional $129 and Enterprise $199 per user/month. Company Workspace has a ten-user minimum; Managed IT has a five-user minimum. Each tier has monthly and prepaid 12-, 24- and 36-month recurring prices, with 8%, 12% and 15% term discounts. Verified nonprofit and education organizations receive a separate 15% community rate across all six tiers through an exact reviewed quote. Legacy agreements retain their own catalog. Creating products does not charge customers.

Step 2. TLS production LIVE key and customer portal verification are complete as of September 14, 2026. Preserve that verified configuration. For a new or isolated test deployment, open Companies > company > Billing and use the protected provider setup form with its own restricted TEST API key, catalog and webhook secret. A connected payment-management app does not install the application credential.

Step 3. Production and QA have separate Stripe webhook endpoints at their respective /api/commercial/webhook URLs, API version 2026-08-26.dahlia. Both subscribe to Checkout completion/asynchronous result, subscription update/deletion and invoice created, updated, finalized, paid, payment succeeded/failed, voided, uncollectible and deleted events. The exact POST callback verifies the raw signature without a browser session; the surrounding QA pages and finance APIs remain owner-protected. A signing secret is not an API key.

Step 4. Configure a Stripe customer portal: enable invoice history and payment-method updates, cancellation at the end of the paid period with no proration, and disable plan/quantity changes. Open Customer billing portal settings for the direct link. Use the account default or enter its bpc_ configuration ID in the protected setup form. Saving an ID is not verification: the app reads the configuration through its key, validates the settings and matching mode, and pins later sessions to it.

Step 5. In the company Plans & billing page, review the secure payment-method summary. Only provider name or card brand, last four digits, default state and expiration are displayed. Full card numbers, bank account numbers, routing numbers, security codes and security answers are never collected by Connect. Use Manage billing securely to add or replace a method on Stripe's hosted page.

Step 6. Verify the 60-, 30- and 7-day expiring-card notice stages and the expired-card notice with a Stripe TEST customer and approved synthetic billing inbox. Confirm the work item is retained after dismissal, and confirm provider acceptance separately from inbox receipt.

Step 7. Choose Verify account and prices. The app checks the Stripe account, USD, licensed pricing, each installed plan amount and all intervals. Read and accept the order policy before a new plan checkout or invoice request. Enable automatic tax only after active registrations are confirmed. Test checkout remains owner-only.

Step 8. Run initial purchase, declined card, partial payment, duplicate/out-of-order webhook, additional-seat approval, renewal, cancellation, grace expiry and recovery tests with dedicated TEST credentials. Check paid seats, invoice ownership, cash evidence and actual page state after every case. The native September 14 synthetic invoice test passed draft to finalized to void with no payment; successful-charge acceptance is still open.

Step 9. For extra seats, request the current invoice estimate and explicitly authorize payment. Quotes expire after five minutes; paid entitlement is updated only after canonical subscription/invoice checks.

Step 10. Run provider acceptance with the actual production key and confirm webhook delivery, checkout, receipts and cancellation. Verify account and prices resets activation when credentials or catalog revision change. After acceptance, the owner-authorized release sets CONNECT_BILLING_LIVE_APPROVED=true in production and redeploys. Dev and QA reject live credentials. Authorizing a payment-management connection alone does not enable portal checkout.

Now verify the result. A canceled checkout or unpaid invoice grants no extra seats. A duplicate event cannot double licenses; a different company’s subscription is rejected. Webhook signature verification, HTTPS, invoice emails, taxes and receipt references work in the actual provider account. An old saved test configuration cannot override the deployed live catalog. A key from the wrong mode is rejected; configuration changes require verification again. Saving changed provider settings clears the previous verification date and disables checkout. Run Verify account and prices again; the panel must not show an old verification as current. A missing customer portal, immediate cancellation, invoice proration on cancellation or direct plan/quantity changes cannot pass verification. Customer portal sessions use the verified configuration ID. Current Stripe invoice status and paid/remaining cents determine settlement; the removed invoice.paid flag is not required. Partial payment never activates unpaid additions. A paid adjustment cannot clear an older unpaid renewal.

If you get stuck. Payment setup required: install the restricted application key, verify the legacy and new plan catalogs, and review the live release gate. The Stripe plugin connection is not a runtime API key. Quote expired: refresh and request another estimate. Existing checkout with different seats: complete it or wait for its 30-minute expiry before changing quantities. If the webhook is private/unreachable, do not activate billing. Use a provider-approved test delivery path in an isolated test deployment. Payment connection authorized but Application API key says Required: finish the protected key form in the portal. The authorization and the application key are separate. Never paste keys into chat. Customer billing portal setup required: save the settings in step 4 in the matching Stripe mode, then select that configuration or the account default and verify again. The application key needs read access to Customer Portal configurations. A connector without portal-write permission cannot create it for you. QA webhook 401 indicates a browser-session gate intercepted the provider callback. Use the released exact signed POST handler; do not remove the owner gate from finance pages. A valid invoice event with a configured mode and signing secret waits in the durable queue if the dedicated TEST API key is missing. Other lifecycle events remain unavailable until that key is installed; no paid entitlement is granted by queuing an event.

Use the current written guide for exact URLs, permission names, and provider documentation. Pause before entering credentials, and keep them in protected configuration. I’m Nora, your TLS guide.