# Credits, billing & renewals

Predictable rental terms with explicit payment state.

Status: Stripe sandbox adapter and ledger implemented · Live payments disabled

## Prepaid credits
The service credits the account only after validating a matching confirmed provider payment. A successful Checkout creation or return-page visit is not payment evidence. Pending and uncertain states must be reconciled before credit is issued.

## Top-up request
`POST /api/v1/topups` accepts `amount_minor` and requires a signed-in session with `billing:write`, plus an `Idempotency-Key`. Ordinary API keys cannot top up an account. Provider and currency checks run on settlement.

## Renewals
30-day terms renew from prepaid balance at the saved rental price; annual terms advance by a calendar year. The worker preserves the paid boundary and prevents duplicate debits. Insufficient credit or a stopped renewal queues suspension rather than claiming physical access has already ended.

## Refunds and webhooks
Refund creation is restricted to an MFA-authenticated administrator. Stripe webhooks require a verified signature and matching configured provider identity. Duplicate webhook deliveries must not add duplicate credit or repeat a refund.

## Current release boundary
Live payments are disabled. Previous sandbox checks verified Checkout creation and an unpaid state without granting credit. Full paid sandbox settlement, replay, refund and physical access lifecycle checks remain necessary before enabling a real charge.