Add billing to your app

// app/api/mindbill/session/route.ts
export async function POST(request: Request) {
  const allowedOrigin = process.env.APP_ORIGIN;
  if (!allowedOrigin || request.headers.get("origin") !== allowedOrigin) {
    return Response.json({ error: "Origin not allowed" }, { status: 403 });
  }

  try {
    const access = await authorizeBillingSession(request);
    if (!access) return Response.json({ error: "Not authorized" }, { status: 403 });
    const response = await fetch(
      "https://app.mindbill.org/partner/v2/browser-sessions",
      {
        method: "POST",
        headers: {
          Authorization: `Bearer ${access.apiKey}`,
          "Content-Type": "application/json",
        },
        body: JSON.stringify({
          subject: access.subject,
          allowedOrigin,
          permissions: access.permissions,
          ...(access.resource ? { resource: access.resource } : {}),
          expiresIn: 900,
        }),
        cache: "no-store",
        signal: AbortSignal.timeout(10_000),
      },
    );

    if (!response.ok) {
      // Log the status only, never keys, session tokens, or response bodies.
      console.error("MindBill session creation failed", response.status);
      throw new Error("Session creation failed");
    }

    return Response.json(await response.json(), {
      headers: { "Cache-Control": "no-store" },
    });
  } catch {
    return Response.json(
      { error: "Billing session unavailable" },
      { status: 503 },
    );
  }
}

// YOUR host adapter, not an SDK export. Connect existing sign-in, CSRF,
// billing roles, and server-owned customer -> MindBill credential mapping.
// Use MINDBILL_API_KEY only for a single authorized organization.
// Return null for denied access. Never accept these values from browser input.
async function authorizeBillingSession(_request: Request): Promise<{
  subject: string;
  apiKey: string;
  permissions: string[];
  resource?: { billId: string };
} | null> {
  throw new Error("Connect existing authentication and customer-key mapping first");
}

// Existing Express server; browser uses same-origin /api/mindbill/session.
app.post("/api/mindbill/session", async (req, res) => {
  if (!process.env.APP_ORIGIN || req.get("origin") !== process.env.APP_ORIGIN)
    return res.status(403).json({ error: "Origin not allowed" });
  try {
    const access = await authorizeBillingSession(req);
    res.set("Cache-Control", "no-store").json(await mintSession(access));
  } catch {
    // Map host auth failures to 401/403; do not expose upstream response bodies.
    res.status(503).json({ error: "Billing session unavailable" });
  }
});

// Server only. Replace this placeholder with your EXISTING auth/tenant/role checks.
async function authorizeBillingSession(_request) {
  throw new Error("Connect existing authentication and customer-key mapping first");
}

async function mintSession(access) {
  const response = await fetch("https://app.mindbill.org/partner/v2/browser-sessions", {
    method: "POST",
    headers: { Authorization: "Bearer " + access.apiKey, "Content-Type": "application/json" },
    body: JSON.stringify({
      subject: access.subject, allowedOrigin: process.env.APP_ORIGIN,
      permissions: access.permissions,
      ...(access.resource ? { resource: access.resource } : {}),
      expiresIn: 900,
    }),
    signal: AbortSignal.timeout(10000),
    cache: "no-store",
  });
  if (!response.ok) throw new Error("Unable to start billing session");
  return response.json();
}

# Existing FastAPI app. Dependency: requests.
import os
import requests
from fastapi import Request, HTTPException
from fastapi.responses import JSONResponse

def authorize_billing_session(request):
    # Implement the required host adapter above. Fail closed until wired.
    raise HTTPException(503, "Connect existing authentication and customer-key mapping first")

@app.post("/api/mindbill/session")
def create_billing_session(request: Request):
    origin = os.environ.get("APP_ORIGIN")
    if not origin or request.headers.get("origin") != origin:
        raise HTTPException(403, "Origin not allowed")
    access = authorize_billing_session(request)
    payload = {
        "subject": access["subject"], "allowedOrigin": origin,
        "permissions": access["permissions"], "expiresIn": 900,
    }
    if access.get("resource"):
        payload["resource"] = access["resource"]
    try:
        upstream = requests.post(
            "https://app.mindbill.org/partner/v2/browser-sessions",
            headers={"Authorization": "Bearer " + access["apiKey"]},
            json=payload, timeout=10,
        )
        upstream.raise_for_status()
        data = upstream.json()
    except (requests.RequestException, ValueError):
        raise HTTPException(502, "Unable to start billing session") from None
    return JSONResponse(data, headers={"Cache-Control": "no-store"})

# Server-to-server ONLY, after host authentication, role and tenant checks.
POST https://app.mindbill.org/partner/v2/browser-sessions
Authorization: Bearer <server-only-sandbox-key>
Content-Type: application/json

{
  "subject": "<authenticated-user-id>",
  "allowedOrigin": "http://localhost:3000",
  "permissions": ["bills:create", "bills:read", "bills:act", "documents:read", "payers:read", "eors:read"],
  "expiresIn": 900
}

# Return successful JSON with Cache-Control: no-store to that authenticated user.
# Reject invalid origins/unauthorized requests BEFORE calling MindBill.
# On failure return a generic error, never upstream response bodies.
# API-only: call bill endpoints server-to-server instead of minting browser tokens.
# https://docs.mindbill.org/api-reference/create-bill