ENGINEERING VERSION LOG · 2026.07

Dodo subscriptions, quotas, and the usage ledger

A checkout page is only the entry point. A billing system must connect identity, entitlements, usage, renewals, and retries into one auditable path.

InkTyper Engineering2026.07.29

$9.99Pro Monthly

$79.99Pro Yearly

1,200 minutesMonthly Pro cloud ASR allowance

500 callsMonthly Pro AI orchestration allowance

ScopeBilling-system design with staged implementationPayment status is not itself usable quota

EvidenceDodo events plus an internal entitlement ledgerObserved results, targets, and estimates are kept separate.

StatusCore path implemented; real transactions need continuing acceptanceThis log records a dated engineering state, not an evergreen promise.

01 · CHECKOUT

Payment is bound to a verified product account

Only a signed-in account may create checkout. The server uses the verified account email for the Dodo session. Cards, payment methods, taxes, and invoices stay on Dodo-hosted pages.

02 · WEBHOOK

Subscription state comes from verified events

The webhook verifies signatures, enforces a five-minute replay window, and deduplicates by event ID. Active, renewed, plan_changed, failed, cancelled, and expired events project into account entitlements.

03 · USAGE LEDGER

Usage follows cost units, not request counts

Cloud ASR is metered by audio milliseconds and AI orchestration by calls. Request IDs are idempotency keys, so network retries do not charge twice. The immutable ledger remains separate from entitlement projection.

04 · PLAN BOUNDARY

Personal plans stay separate from future API plans

Free provides a bounded trial and Pro provides fixed monthly ASR minutes and AI calls. Future Team/API plans require separate concurrency, shared quotas, and usage overages rather than being mixed into individual subscriptions.

EVIDENCE · DIAGNOSIS

What the evidence establishes—and what it does not

Dodo is the source of payment events; InkTyper owns account entitlements and an immutable usage ledger. Webhooks require signature, time-window, and event-idempotency checks. Transcription is metered in audio_ms, AI by operation, and retries deduplicate on request ID.

Reading ruleProduction observations describe the observed path. Controlled benchmarks isolate a component. Targets remain targets until a sustained distribution proves them.

OPERATIONS · OPEN WORK

Failure behavior and the next verification gate

Gifted Pro, developer access, and paid subscriptions should project into the same entitlement model while retaining different sources, so the system can explain why quota exists. A future API plan needs separate concurrency, keys, metering, and overage rules rather than borrowing consumer Pro limits.

Failure visibility: Every fallback needs a reason code and stage timing. A successful final transcript must not erase evidence that real-time, AI, or paste failed first.
Release evidence: Keep request ID, actual model, node, queue, upload, ASR, AI, and delivery timing together so a regression can be reconstructed end to end.