# QI billing activation checklist

## Current status

Live QI checkout was enabled on September 12, 2026 after owner approval. The dedicated Stripe prices, webhook signature verification, entitlement storage, policy acknowledgements, and signed-workspace access gate have been verified in production. No customer payment was created during verification.

Do not reuse another product's prices or webhook secret.

## Approved public terms

- Plans: Starter `$49/month`, Studio `$149/month`, Platform `$399/month`.
- Terms: `/qi-terms.html`, version `qi-terms-v1`.
- Refund policy: `/refund-policy.html`, version `qi-refund-v1`.
- Customers must acknowledge both documents before a checkout session can be created.
- Customer-facing use and support: `/QI-CUSTOMER-QUICKSTART.md`.

## Netlify function variables

Set these in the production Functions context using the protected environment-variable UI or CLI. Never commit their values or paste secrets into source control.

| Variable | Purpose |
| --- | --- |
| `QI_STRIPE_PRICE_STARTER` | Dedicated recurring USD price ID for `$49/month` |
| `QI_STRIPE_PRICE_STUDIO` | Dedicated recurring USD price ID for `$149/month` |
| `QI_STRIPE_PRICE_PLATFORM` | Dedicated recurring USD price ID for `$399/month` |
| `QI_STRIPE_WEBHOOK_SECRET` | Signing secret for `https://qurmmius.com/api/qi/stripe-webhook` |
| `QI_ENTITLEMENTS_ENABLED` | Set `true` only after webhook and storage verification |
| `QI_ALLOW_CHECKOUT` | `true` in production after the complete smoke test and owner approval |

The existing company/product Stripe variables are intentionally not consumed by QI. The webhook must be configured for `checkout.session.completed`, `invoice.paid`, payment failures, and `customer.subscription.deleted`, with metadata for product, plan, workspace, and user.

## Completed verification order

1. Created the three dedicated QI recurring prices in the correct Stripe account.
2. Registered `https://qurmmius.com/api/qi/stripe-webhook` for checkout completion, paid invoices, and subscription deletion, with signature verification.
3. Confirmed scoped entitlement writes and customer-portal linkage behavior.
4. Ran signed webhook grant/revoke smoke tests; both returned HTTP 200 and stored audit results.
5. Confirmed `QI_ENTITLEMENTS_ENABLED=true`, policy versions, prices, and webhook configuration in the production health check.
6. Set `QI_ALLOW_CHECKOUT=true`, redeployed, and confirmed the production catalog has no activation blockers.

The checkout endpoint remains protected: requests without a signed invited workspace return `qi_auth_required`, and a real session also requires acknowledgement of both the QI Terms and Refund Policy. Monitor the first live invoice and webhook delivery from Stripe Workbench.

For a concise customer handoff, use the [QI customer quickstart](/QI-CUSTOMER-QUICKSTART.md). This does not change the owner-controlled pilot invitation process.