Checkout custom_data arrived empty and the card was still charged
When a signed-in user starts checkout, the backend opens a Lemon Squeezy checkout and sets custom_data.user_id to that account. The subscription_created webhook is what attaches the paid plan. The handler reads custom_data.user_id to know which account. A subscription_created webhook arrived without user_id . The checkout had started from an authenticated session, so the field should have been…
When a user begins the checkout process, the system opens a Lemon Squeezy checkout and assigns a custom_data.user_id, which corresponds to the user's account. However, during one checkout, the custom_data.user_id field was missing, despite the user having started the checkout from an authenticated session. The subscription_created webhook, responsible for attaching the paid plan, failed to retrieve the user_id, which is essential for identifying the correct account.
The source material explicitly states that this incident did not imply that the provider consistently omitted custom_data fields. Instead, the system intentionally blocked the handler from attaching a subscription when the user_id was absent, as attaching it without a valid user could lead to ambiguity and the plan being mistakenly assigned to the wrong account.
Despite the absence of a user_id, the card was still charged, and the subscription was created on the provider's side, while the account remained on the free plan. The source material does not provide additional details or consequences beyond these facts.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
