Dodo payment connectors (early access)

Payment connectors are now available to enabled tenants, starting with Dodo Payments. This is an additive early-access release: existing manual top-up and prepaid-renewal integrations continue to work.

Added

• Multiple provider connections per tenant and environment, with write-only encrypted API keys and webhook secrets.
• Connection-specific signed callback URLs and 24-hour previous-secret overlap during webhook-secret rotation.
• Verified mappings from Dodo one-time products to QuotaStack top-up packages and fixed recurring products to prepaid plan variants.
• POST /v1/payment-checkouts for provider-hosted checkout and GET /v1/payment-checkouts/{id} for checkout display/reconciliation state.
• Optional payer email/name prefill. When omitted, Dodo collects customer details in hosted checkout.
• Exactly-once top-up, initial subscription, and recurring renewal effects after verified payment.succeeded.
• Normalized payment and subscription event processing with retry, dead-letter visibility, and reconciliation.
• Restricted API-key scopes payments:write for checkout creation and payments:read for checkout reads. Existing keys with an empty scope list retain legacy all-access behavior.

Ownership boundary

Dodo owns money collection, payment methods, mandates, SCA, recurring charge attempts, and dunning. QuotaStack owns product mapping, subscription state, credit blocks, usage metering, and entitlements.

A hosted-checkout return is not payment proof. QuotaStack grants paid credits or advances a paid period only after a verified successful provider event.

Mapped products cannot use Dodo Credits, usage meters/pricing, or a Dodo-managed trial, and a QuotaStack plan variant with a free trial cannot be a connector target. Those features would create a second credit ledger or lifecycle clock alongside QuotaStack.

Manual integrations still work

The existing tenant-facing paths remain for integrations that verify their own provider webhooks:

• POST /v1/topups/grant
• POST /v1/subscriptions/{id}/renew

Do not call those manual endpoints for connector-managed payments. A connector-managed subscription rejects public manual renew with 409 Conflict, and the scheduler does not open paid periods without provider payment proof.

Start here

• Payment Connectors concept
• Connect Dodo Payments
• OpenAPI reference