I sell a paid desktop plugin called AnimKit, and I also run several freemium mobile apps, so I've handled feature access in two very different ways: building the system myself, and relying on a managed billing service.
The biggest lesson came from AnimKit, and honestly, it was a painful one.
The bug: paying customers, and nothing happens
AnimKit is sold through Gumroad, and whenever someone buys it, Gumroad sends a webhook to my system. That webhook is supposed to trigger the license-generation process and email the buyer their license file.
During an unrelated cleanup, I removed a serverless file because I was trying to stay within the limits of a free hosting plan. I didn't realize that the file I deleted was also the one receiving Gumroad's webhooks.
From that point on, every purchase notification hit a 404.
The worst part was that nothing looked broken from my side. Sales were still appearing normally in Gumroad. There was no warning, no obvious error, and no alert telling me that customers were paying but not receiving their licenses.
It continued for around six weeks.
I eventually found the issue by using Gumroad's own test-webhook button. The test came back with a 404, and that was the moment I realized what had been happening.
The financial loss was not enormous, because AnimKit was still new. The trust problem was much worse. For six weeks, people paid for the product and received nothing automatically. From their point of view, they had no way of knowing whether it was a technical problem or whether they had just been scammed.
What changed: from my own code to a managed system
That experience changed how I think about paid access.
On the mobile side, I use RevenueCat to manage subscriptions instead of writing all the billing and permission logic myself. The biggest difference is that I no longer have to think through every possible purchase state on my own.
With the Gumroad setup, I have to account for everything manually: failed webhooks, test events, refunds, duplicate notifications, renewals, and unexpected edge cases.
With a managed system, the question becomes much simpler: "Does this user currently have access to this entitlement?" I ask the system, and it gives me the current answer.
That does not mean managed billing removes every problem, but it removes a large amount of fragile custom logic that I would otherwise have to maintain myself.
The one thing I'd tell my past self
A paywall that fails silently is more dangerous than one that fails loudly.
The worst feature-access bugs I've shipped were not dramatic crashes. They were invisible failures: a customer paying and receiving no license, or a webhook returning errors for weeks without anyone noticing.
One basic alert could have prevented most of it. If the system had notified me whenever a payment was received but no license was delivered, I would have caught the issue within a day instead of several weeks.
For indie builders, the free-versus-paid decision is only one part of the problem. The harder part is making sure the paid side actually works every single time someone trusts you enough to spend money.
_Related: running a software studio solo with AI and real AI success stories, honestly assessed._
