> Lemon Squeezy: what your AI agent should know — from The Handover, the-handover.org/services/lemon-squeezy
> © Captivated Ltd — free to use in your own work, not to redistribute as a collection. the-handover.org/licence

# Lemon Squeezy

What we tell an AI agent working on a project that uses Lemon Squeezy: 1 rule, 0 learned the hard way.

Build a full rootnote set for a Lemon Squeezy project: https://the-handover.org/build?areas=working-agreement,payments,licensing&payments=lemonsqueezy&licensing=lemonsqueezy

Lemon Squeezy published no file for agents when last checked; this page is the only agent-facing guidance for it we know of.

## Lemon Squeezy for payments

### Lemon Squeezy: verify webhooks, keep test mode apart, and leave tax to it

> General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-18

- **Verify the webhook signature — an HMAC of the raw body with your signing
  secret — before parsing or acting.**
- **Make handlers idempotent.** The same event can arrive more than once.
- **Keep test mode and live mode apart**, including their webhook secrets.
- **Do not build tax handling or invoicing.** Lemon Squeezy is the merchant of
  record; doing it again produces a second, disagreeing version.

## Lemon Squeezy for licensing

Also applies to every licensing choice, so not repeated here: Revoke a licence when what was paid for ends, never when the customer cancels; A licence check must never lock out somebody who paid.