
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@botparty/checkout-nextjs
Advanced tools
NextAuth-style Next.js SDK for the BotParty checkout service: catch-all App Router handler + React provider, hooks, and gate components.
NextAuth-style Next.js SDK for the BotParty checkout service.
pnpm add @botparty/checkout-nextjs
defineCheckout({...}) factory that drives both the server route
handler and the React client.app/api/checkout/[...checkout]/route.ts and you're done.<CheckoutProvider>, hooks (usePurchaseStatus, useLedger,
useInvoices, useStartPurchase), gates (<HasPurchased>,
<HasNotPurchased>, <PurchaseGate>), and headless components
(<PurchaseButton>, <Ledger>, <Invoices>).campaigns service when
botpartyMiddleware is installed (or via a _mcmpid cookie/query as a
fallback).src/lib/checkout.ts — the source of truth:
import { defineCheckout } from "@botparty/checkout-nextjs/server";
import { auth } from "@botparty/nextjs/server";
export const checkoutConfig = defineCheckout({
apiToken: process.env.CHECKOUT_API_TOKEN!,
async getUser() {
const s = await auth();
return s.isAuthenticated ? { id: s.userId!, email: s.email } : null;
},
async getCampaignShortId() {
const s = await auth();
return (s as any).meta?.cmpid ?? null;
},
successUrl: "/thank-you",
cancelUrl: "/pricing",
products: [
{ slug: "lifetime", title: "Lifetime", amountInCents: 4999, type: "one-time", maxPerUser: 1 },
{ slug: "credits-10", title: "10 Credits", amountInCents: 999, type: "one-time" },
{ slug: "pro-plan", title: "Pro", amountInCents: 1999, type: "subscription", period: "monthly" },
],
});
src/app/api/checkout/[...checkout]/route.ts — the catch-all handler:
import { createCheckoutHandler } from "@botparty/checkout-nextjs/server";
import { checkoutConfig } from "@/lib/checkout";
const handler = createCheckoutHandler(checkoutConfig);
export const GET = handler.GET;
export const POST = handler.POST;
src/app/layout.tsx — wrap the tree:
import { CheckoutProvider } from "@botparty/checkout-nextjs/client";
export default function Layout({ children }) {
return (
<html><body>
<CheckoutProvider basePath="/api/checkout">{children}</CheckoutProvider>
</body></html>
);
}
src/app/pricing/page.tsx:
"use client";
import { PurchaseButton, HasPurchased } from "@botparty/checkout-nextjs/client";
export default function Pricing() {
return (
<>
<PurchaseButton productId="lifetime" redirectUrl="/thank-you">Buy lifetime</PurchaseButton>
<PurchaseButton productId="pro-plan" redirectUrl="/thank-you">Subscribe</PurchaseButton>
<HasPurchased productId="lifetime">
<p>Welcome back, lifetime member 👋</p>
</HasPurchased>
</>
);
}
createCheckoutHandlerAll paths are relative to basePath (default /api/checkout):
| Method | Path | Description |
|---|---|---|
| GET | /products | Returns the static catalog (or live from apps/checkout) |
| GET | /:slug | Single product info |
| GET | /:slug/purchase?... | Starts upsell/hosted Stripe Checkout, 302s away |
| GET | /:slug/status | { hasPurchased, purchase? } for the current user |
| GET | /ledger | Current user's purchase ledger |
| GET | /invoices | Current user's invoices |
| POST | /sync | Force product sync into apps/checkout |
The /:slug/purchase route reads _mcmpid (via getCampaignShortId,
_mcmpid cookie, or ?_mcmpid= query) and forwards it to apps/checkout as
campaignShortId, so attribution survives the Stripe round-trip.
@botparty/checkout-nextjs/server — defineCheckout, createCheckoutHandler,
fetch helpers (createLink, upsell, hasPurchased, listLedger, …).@botparty/checkout-nextjs/client — <CheckoutProvider>, hooks, gates,
buttons, ledger components.@botparty/checkout-nextjs — re-exports the server entry. Don't import this
from a client component; use /client instead so React isn't pulled into
your server bundle.See templates/nextjs for a full working example.
FAQs
NextAuth-style Next.js SDK for the BotParty checkout service: catch-all App Router handler + React provider, hooks, and gate components.
We found that @botparty/checkout-nextjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.