Usage-based billing tracks metrics accurately

Usage-based billing only works if usage is recorded server-side at the moment of the metered action. Client-side usage tracking (localStorage, session state) can be cleared, manipulated, or simply dropped on session expiration — meaning you never bill for real consumption. CWE-20 (Improper Input Validation) applies when client-supplied usage counts are trusted. ISO 25010 functional-correctness requires that what you charge matches what was consumed. Under-billing erodes revenue directly; over-billing from timing gaps creates customer disputes.

Record usage server-side at the point of the metered action, synchronously, before returning a response. Track locally for display and report to Stripe in the same request.

// app/api/ai/generate/route.ts
export async function POST(req: Request) {
  const session = await getServerSession()
  const user = await db.user.findUnique({ where: { id: session.userId } })

  const result = await runAIGeneration(req)

  // Record usage AFTER successful action — server-side, not client-side
  await stripe.subscriptionItems.createUsageRecord(
    user.stripe_metered_item_id,
    { quantity: 1, timestamp: 'now', action: 'increment' }
  )

  // Also persist locally for the usage dashboard
  await db.usageRecord.create({ data: { userId: user.id, action: 'ai_generation' } })

  return Response.json({ result })
}

Never accept usage quantities from the client request body. Always derive quantity from the server-side action.