From checkout to verified access.

Match your checkout to your website

In your dashboard, open Checkout designer and choose Match my website. UnlockLane reads the public page and up to four same-site stylesheets, then suggests a color palette, a similar system font style, and corner radius. Adjust the colors and preview the checkout, payment-page styling, and access-code page at wide or phone width. The payment-page preview is a style reference, not an exact rendering of the hosted page.

Save checkout design applies it to every UnlockLane checkout for that website. A scan only updates your private preview. Discard edits returns to your saved design; Restore default removes the custom styling. Text contrast is checked before saving.

Style matching is an approximation based on public HTML and CSS, not a screenshot or a full copy. Script-rendered styles, external stylesheets, blocked pages, images, logos, and custom font files may not be imported. You can always choose the styling manually. Only the design settings are saved; downloaded page content is not retained. The scan makes public website and DNS requests without sending your account credentials. For newly created payment sessions, UnlockLane sends the saved background, button color, business display name, closest supported font, and corner style. The payment provider controls its layout and text contrast; existing merchant logos remain in place. Sessions already opened keep their original branding. The access-code page also uses the saved theme.

1. Connect your website

1. Open your dashboard and select Live payments for a product billed through UnlockLane, or Sandbox for optional connected-account testing.
2. Create a plan. Copy the checkout URL and exact site slug from API keys & integration.
3. Store the site API key in your backend’s secret settings. Deploy or restart that backend after changing its secret. Never place the key in browser code, a public environment variable, or a URL.
4. Use the dashboard connection tester, then run this request from your own deployed backend. These are separate checks.

const response = await fetch('https://unlocklane.com/api/v1/connection', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.UNLOCKLANE_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ site: 'YOUR_SITE_SLUG' }),
  redirect: 'manual',
  cache: 'no-store',
  signal: AbortSignal.timeout(10000),
});
if (!response.ok) throw new Error('Connection check failed');
const result = await response.json();
// connected: true confirms authentication. It NEVER grants access.
// Check result.mode: "test", "live", or "unconfigured".

This is UnlockLane’s canonical API host. The public website and checkout links use unlocklane.com. Both belong to the same service. Manual redirect handling works on Cloudflare Workers; treat every non-success response as a failed check.

3. Prove the complete flow

1. Confirm test mode in the dashboard and Stripe checkout. Use only Stripe’s test payment details.
2. Run the connection check. An authenticated response proves the site/key pair, not payment completion.
3. Complete a test checkout and save the code shown on the success page.
4. Verify that code from your backend. Check the entitlement, future expiry, and test mode. Confirm invalid codes and network failures keep protected access locked.
5. Test a subscription change in Stripe and confirm a signed Connect webhook reaches https://unlocklane.com/api/stripe/webhook. Then verify access again.

UnlockLane receives Stripe lifecycle events; it does not send webhooks to your application. The current handlers support paid checkout completion, asynchronous payment success, subscription updates/deletion, paid invoices, refunds and disputes. Platform collection requires an account webhook, while existing connected checkouts use Connect events. A configured signing secret is not evidence of successful webhook delivery.

Before a live launch, review merchant eligibility with Stripe and test cancellations, payment failures, and recovery. Test/live accounts and prices are separate in Stripe. UnlockLane stores each website’s environment permanently and keeps separate Stripe account connections. Existing records are retained in the sandbox. The operator configures STRIPE_LIVE_SECRET_KEY, STRIPE_LIVE_WEBHOOK_SECRET, and LIVE_PAYMENTS_ENABLED=true only after the appropriate live payment arrangement is confirmed. The live webhook endpoint is /api/stripe/webhook?mode=live; the existing endpoint remains test-only. Keep existing test credentials and ACCESS_CODE_SECRET unchanged. Switching credentials never converts a test website into a live website.

Automatic access-code emails

After payment is confirmed, UnlockLane queues one code email per subscription. When Resend is configured, it submits the email automatically using the publisher’s saved checkout colors, font category, and site name. Customers can also copy their code on the confirmation page. Sandbox emails are marked TEST and must not activate paid access.

The operator must configure a Resend API key and a sending address on a verified domain. Messages display the publisher’s name via UnlockLane and use UnlockLane’s sending address; individual merchant sending domains are not supported yet. In the dashboard, Access-code emails shows a preview and recent submission status. Set each website’s Subscription management URL to its HTTPS account page on the registered domain. New emails name the website in the footer and link that name to this page; without a configured link the name remains plain text. ScrollXXX uses its subscription-section link by default. Previously queued emails keep their original footer and link. Queued or failed submissions can be retried by the site owner. Accepted means the provider accepted the message, not inbox delivery. Bounce and delivery notifications are not tracked. No scheduled email job runs; Payment notifications retry temporary submission failures, and the owner can retry from the dashboard.

If email is unavailable, save the code on the confirmation page and contact the publisher for help. Once an unconfirmed submission is 23 hours old, automatic retries stop to avoid duplicate emails; the operator must inspect the provider’s logs. Welcome emails are not sent on every renewal.

New ScrollXXX access-code emails use its dark charcoal-and-pink palette, independently of a saved light checkout design. Other websites keep their saved theme. Email clients can adjust appearance. Previously queued or delivered emails keep their original design; retrying does not restyle them.