Services
Lemon Squeezy
What we tell an AI agent working on a project that uses Lemon Squeezy —1 rule.
Build a rootnote set for a Lemon Squeezy projectPlain text
Lemon Squeezy did not publish a file for agents when we last checked, so this page is the only agent-facing guidance for it we know of. Why that matters.
Everything here is general guidance: rules an agent knows but does not reliably follow. We have not been caught out by Lemon Squeezy ourselves, and this page does not pretend otherwise.
Lemon Squeezy for payments
Lemon Squeezy: verify webhooks, keep test mode apart, and leave tax to it
General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-18
- Verify the webhook signature — an HMAC of the raw body with your signing
secret — before parsing or acting.
- Make handlers idempotent. The same event can arrive more than once.
- Keep test mode and live mode apart, including their webhook secrets.
- Do not build tax handling or invoicing. Lemon Squeezy is the merchant of
record; doing it again produces a second, disagreeing version.
Lemon Squeezy for licensing
Also applies to every licensing choice, so it is not repeated here:
- Revoke a licence when what was paid for ends, never when the customer cancels
- A licence check must never lock out somebody who paid
All of it is included when you build a set.