Production engineering · Mobile commerce
Entitlements that remain correct when callbacks repeat, clients disappear, and gateways fail.
At Mogi I/O, I lead subscription and payment work for a React Native OTT platform: StoreKit, payment gateways, webhooks, and entitlements.
- Role
- Lead mobile and payment integration engineer
- Product
- React Native OTT platform
- Systems
- StoreKit · Razorpay · PhonePe · Tangerine
- Backend
- Node.js · Webhooks · AWS Lambda · SQS
- 01 React Native client Initiate purchase
- 02 Provider Process payment
- 03 Backend authority Verify event
- 04 Entitlement service Assign access once
The invariant
A checkout callback is a user-interface event, not proof of payment.
Mobile payments cross app switches, provider SDKs, delayed webhooks, retries, and killed processes.
The invariant is simple: assign access only after server-side verification, and apply each verified transaction once.
Verification before assignment
Make the authoritative path idempotent.
Provider notifications are retried by design. Treating every delivery as a new business event creates duplicate orders and inconsistent access.
- 01
Receive
Accept the webhook independently of the client’s current state.
- 02
Authenticate
Validate provider authenticity before trusting event content.
- 03
Verify
Resolve the transaction against the provider and the expected internal purchase context.
- 04
Deduplicate
Use the provider transaction identity to recognize an effect already applied.
- 05
Assign
Create or update entitlement only after the preceding checks succeed.
This verify-before-assign path eliminated duplicate order creation and prevented unverified entitlement grants. Retries became safe instead of exceptional.
Multiple rails
One product, several commerce models.
StoreKit subscriptions
In-app purchases, auto-renewable subscriptions, restore behavior, Offer Codes, and server-side receipt validation.
UPI and debit AutoPay
Razorpay and PhonePe flows covering mandate authorization, subsequent charges, and state transitions beyond checkout.
Card payments
Gateway configuration and investigation across currencies, risk failures, and production transaction cases.
Vendor split payouts
Razorpay Route transfers separated collection from downstream vendor settlement.
Failure as a normal state
An authorized payment can still require operational recovery.
During a gateway outage, AutoPay subscriptions were authorized but not captured. Provider state, order state, and access state diverged.
I led the recovery work with Razorpay support. The same work covered stale entitlements, retry loops, listener leaks, and restore behavior.
- Model intermediate provider states instead of collapsing them into success or failure.
- Keep enough transaction context to reconcile after the original client session ends.
- Separate retryable processing from permanent business rejection.
- Instrument the authoritative backend path, not only the checkout UI.
Outcome
A payment system built around invariants instead of happy paths.
The resulting flow made duplicate webhooks safe, blocked unverified grants, and gave incidents a traceable source of truth.
Read the engineering notes