No way to bypass payment via API

Any API route that accepts a client-supplied plan, tier, or subscription_status and writes it directly to the database is a privilege escalation vulnerability. OWASP A01 (Broken Access Control) and CWE-602 (Client-Side Enforcement of Server-Side Security) describe this precisely: the client is never a trusted source of truth about its own entitlements. An attacker can upgrade themselves to any plan tier with a single crafted POST request. PCI DSS Req 8.2.1 requires that access to payment-related data is based on verified identity, not client assertion.

Subscription state must only flow from verified webhook events — never from client-supplied fields. Your upgrade route should create a Checkout Session or Payment Intent and return a redirect URL; the plan change happens only after Stripe sends a verified webhook.

// WRONG — never do this
// app/api/user/upgrade/route.ts
await db.user.update({ data: { plan: body.plan } }) // trusts the client

// RIGHT — in your verified webhook handler only:
case 'customer.subscription.updated': {
  const subscription = event.data.object
  await db.user.update({
    where: { stripe_customer_id: subscription.customer as string },
    data: {
      plan: subscription.items.data[0]?.price.lookup_key ?? 'free',
      subscription_status: subscription.status
    }
  })
}

Your upgrade API endpoint should only call stripe.checkout.sessions.create() and return the session URL — never touch the user's plan field directly.