Most of what a business system is worth happens at the seams: where it takes a
card, sends the email, books the domain, asks the model, or reads the tax rate. These are the
seams I have built, with the real numbers behind them.
17third-party APIs integrated across Rental Pilot and Lend Pilot
905routes in the Rental Pilot API, which I wrote and run
287,068calls to that API in production over the last two weeks
195route handlers in the Lend Pilot API
What it talks to
Every line is a live integration in code I wrote. Hover or tap one for what it does.
Money
Messages
AWS
AI
Data
Stripe, done defensively
Subscription billing for Rental Pilot tenants.
Built and verified end to end in Stripe's test mode. Live keys go in when the first paying tenant does.
The card never touches my servers: Checkout and the Billing Portal are Stripe-hosted, and the only thing that comes back is a signed event.
What it handles
Checkout for new subscriptions, the Billing Portal for everything after
Five webhook events, each signature-verified before it changes anything
A 30-day free trial that still asks for the card up front
Proration on plan changes, promo codes, optional Stripe Tax
A guard that sends a tenant who already pays to the portal instead of opening a second subscription
Seven scenarios, run end to end
Trial
Checkout
Upgrade
Declined card goes past due
Retry brings it back
Cancel
Re-subscribe
All seven webhooks returned 200 in the sandbox run.
Two weeks of production traffic
Calls to the Rental Pilot API per day, from the server's own access logs.
Web, iPhone, Android, desktop and the customer portal all call the same API.Show as a table
Day
API calls
How I wire an integration
the same rules every time
Hosted where money is. Card fields belong to the processor, so the system never sees a card number and the compliance scope stays small.
Verify, then act. Every webhook is signature-checked and safe to receive twice.
Sandbox first. Each integration is run end to end against the provider's test environment before a live key exists.
Secrets stay out of code. Keys live in the environment, and a leaked key is rotated, not patched around.
Expect the seam to fail. Timeouts, retries with backoff, and an alert to my phone when an outside service starts erroring.