CLOUDFLARE DEPLOYMENT
Make the gate real.
Static HTML cannot securely verify payment. Do not trust a query string, local storage value, hidden HTML, or client-side JavaScript flag.
- Verify provider webhooks using the provider’s official signature verification and a Worker secret.
- Store only the minimum entitlement record in KV or D1.
- After an authenticated user session, issue a short-lived signed access token.
- Verify the token with Web Crypto before returning protected HTML.
- Keep provider secrets, webhook signing secrets, and HMAC keys out of GitHub and browser code.
- Return an HTML response or HTML redirect for every user-facing failure.
A non-production Worker contract sketch is included at worker/gate.js. It deliberately returns no access until reviewed provider verification and token logic are implemented.