Billing portal

Send users to their billing pages on Anikeen ID – payment methods, invoices, subscriptions and orders – instead of building them yourself.

For the signed-in user (user token)

POST /api/v1/billing/portal
Authorization: Bearer USER_TOKEN

{"return_url": "https://shop.example.com/account"}

{"data": {"url": "https://…"}}

Returns the URL of a payment portal session (powered by Stripe) where the user manages their payment methods, and which leads back to return_url. With the SDK:

return redirect()->away($user->billingPortalUrl(route('account')));

$user->profilePortalUrl($returnUrl) similarly links to the user's profile settings on Anikeen ID.

Billing portal links (trusted apps)

A "Manage billing" button for a user whose token your app doesn't have (e.g. the owner of a team your app bills): create a link with the app's token (scope subscriptions:client or orders:client). Like Stripe's customer portal, it works without a login.

POST /api/v1/client/users/{user}/billing-portal
Authorization: Bearer APP_TOKEN

{"return_url": "https://app.example.com/teams/42", "group": "42", "flow": "invoices"}

Field
return_url	optional; the origin of one of your redirect URIs (422 otherwise). The pages show "Back to your app", which leads there
group	optional: only this group's subscriptions (and the orders, invoices and transactions billing them)
flow	overview (default), payment_method, payment_method_update, invoices, subscriptions or orders

{"data": {"object": "billing_portal_link", "url": "https://id.anikeen.com/billing/portal/…",
  "user_id": "01j…", "flow": "invoices", "group": "42",
  "return_url": "https://app.example.com/teams/42", "expires_at": "…"}}

Route::post('teams/{team}/billing', function (Team $team) {
    return redirect()->away($team->owner->appBillingPortalUrl([
        'return_url' => route('teams.show', $team),
        'group' => $team->id,
        'flow' => 'invoices',
    ]));
});

app(\Anikeen\Id\AnikeenId::class)->createBillingPortalLinkForUser($userId, ['flow' => 'payment_method_update']);

How the link behaves

• The link is single use and valid for about 15 minutes. Create it when the user clicks and redirect right away; don't store, mail or reuse it (a second request with the same link, e.g. a reload, gets a 403).
• Opening it starts a portal session for that user that needs no login and signs nobody in: only the billing pages of the flow, only what bills your app's subscriptions (of the group), with "Back to your app".
• The user's account settings, other apps and OAuth consent stay behind the normal login. Signed in as another account, the portal still shows only the link's user.
• The session ends after an hour without activity or on "Back to your app".
• payment_method_update leads straight to replacing the payment method (e.g. after a failed payment) and back to return_url. The payment method belongs to the account, so the new one applies to all of the user's apps.

Errors: 403 for an untrusted app, a user token or a missing scope; 404 for an unknown user; 422 for validation.