Paid in Stripe but no access? 5 things to check

A customer emails: "I paid, and I still can't use it." Stripe shows the payment. Your app shows a free account. In apps built with Lovable, Bolt, Replit or v0 this almost always comes down to one of five causes, and you can find which one in about 15 minutes.

By Max Zeshut, 27 October 2026.

First: what should happen

When someone pays, Stripe sends your app a message called a webhook: "this checkout was paid, by this customer". Your app checks the message really came from Stripe, then unlocks the plan. The redirect back to your "thanks" page is only a courtesy. It can fail, be closed early, or be visited by anyone who knows the address, so it should never be what unlocks anything.

Every cause below is a break somewhere in that chain.

1. The app unlocks on the success page, not the webhook

This is the most common one in AI-built checkouts. The plan is switched on when the browser lands on /success. If the customer closes the tab during the redirect, their phone loses signal, or their bank asks for a confirmation step that ends somewhere else, the page never loads and nothing is unlocked. The reverse is worse: anyone who finds that address gets the paid plan without paying.

Check yours: open your success page in a private window, signed in as a free test account, without paying. If the account changes, this is your problem.

2. There is no live webhook, only a test one

Stripe keeps test mode and live mode completely apart: separate keys, separate webhook endpoints, separate signing secrets. Apps often get built and tested in test mode, then switched to live keys, and the live webhook is never created. Everything worked when you tried it. It stops the first time a real card is used.

Check yours: in Stripe, switch to live mode, then open Developers, then Webhooks. There should be an endpoint on your real domain.

3. The webhook points at the wrong address

The endpoint exists, but it points at the preview address, an old domain, or a path that has moved. Stripe sends the message, gets a 404 or a timeout back, and keeps retrying for up to three days while your customer waits.

Check yours: open the live endpoint and look at recent deliveries. Red failures, or no deliveries at all after a real payment, mean the messages aren't arriving. Click one to see the response your app sent back.

4. The signature check fails

A correct webhook handler checks Stripe's signature with the endpoint's signing secret before trusting the message. If the app has the test secret while receiving live messages, every delivery fails with a 400, and the handler does exactly what it should: refuse it. Some hosting setups also change the message body before your code reads it, which breaks the check the same way.

Check yours: if deliveries show 400 errors mentioning a signature, compare the signing secret in your app's settings with the one shown on the live endpoint. They start with whsec_ and must match.

The opposite, a handler with no signature check at all, works every time, and it's worse: anyone can send it a fake "paid" message.

5. The payment arrives, but can't be matched to the user

The webhook gets through, but the app can't tell who paid. The checkout was opened without the user's id, or the handler looks people up by email and the customer typed a different one at checkout. The handler finds no one, does nothing, and still tells Stripe it succeeded, so nothing looks wrong on either side.

Check yours: buy your own plan in live mode with a different email from your account's, then refund it. If the account doesn't change, the matching is broken.

While you're in there

Cancellations and failed renewals use the same chain in reverse. If the app only listens for "paid", people who cancel keep the paid plan for ever. Check that a cancelled test subscription loses access too.

And answer the customer who emailed first: unlock their account by hand and tell them it's sorted. A customer who hears nothing tends to ask their bank for the money back, and a chargeback costs you a fee on top of the refund.

If you'd rather have it fixed

This is one of the things a Launch Check covers. For $299 I go through your payments, data rules, keys and the rest within 48 hours, fix the three worst problems, and send you a written report. For Stripe that means one signed webhook on your live domain that grants and removes access, with a real test purchase, refund and cancellation written down. More on Stripe webhooks.