Clerk → Supabase → Stripe

Architecture

1. 01clerkuser signs in; session minting starts here
2. 02supabaserls sees a bridged jwt with clerk user id as subject
3. 03stripecheckout.session.completed upserts subscription row

Env-var matrix

Security checklist

• bridge clerk uid into supabase jwt before rlsauth.uid() is null on a raw clerk token
• verify stripe signature on every webhookunsigned events can be spoofed
• upsert subscription by stripe idwebhook can land before the client write

Folders

· src/auth/clerk-supabase.ts
· src/webhooks/stripe.ts
· src/lib/verify.ts