Paddle's approved-domain check only applies in the browser

I ship a lot of small products. Browser extensions, little SaaS tools, one game. Most of them live on their own subdomain and do exactly one job. For a long time the worst part of starting a new one wasn't the product. It was billing. Bank verification, ID verification, waiting for approval, recreating the same plans, wiring the same webhooks, testing the same four subscription states. Every single time. I got good at it the way you get good at anything you resent. So I stopped doing it per product and did it once for all of them. Here's the shape that fell out, including the part I had wrong for months. The thing I had wrong Paddle has a list of approved domains. My assumption was that every site taking money had to be on that list, which meant a review round per subdomain, forever. That's not what the list gates. Approved domains gate the Paddle.js checkout overlay running in a browser . That's it. The server side doesn't care: webhook signature verification: not domain gated creating a customer portal session with the API key: not domain gated your own internal endpoints receiving forwarded events: obviously not domain gated Exactly one thing in the whole flow has to happen on an approved domain, and it's the moment the overlay opens. Everything else can live wherever you want. Once I saw that, the design was basically forced. The shape One payment account. One approved domain, the apex. One webhook endpoint, on that apex, for the entire family: Paddle ──webhook──> apex.example.com/api/webhook/paddle │ ├─ verify signature ├─ read custom_data.site └─ route: own event → handle locally other site → forward raw event to that site unknown → 200 and drop it Two rules make this hold up, and both are about what the shared piece refuses to know. The dispatcher does not know a single price ID. It verifies the signature, reads one field, and forwards the raw snake_case event onward. Mapping a price to a plan, granting credits, writing to a subscription table: all of that li