When a signed-in user starts checkout, the backend opens a Lemon Squeezy checkout and sets custom_data.user_id to that account. The subscription_created webhook is what attaches the paid plan. The handler reads custom_data.user_id to know which account.

A subscription_created webhook arrived without user_id . The checkout had started from an authenticated session, so the field should have been there. It was not. One missing field on one event. That does not mean the provider always drops custom_data .

The refusal was intentional

I kept the handler from attaching a subscription when user_id is missing. A webhook that carries a payment and no owner is ambiguous. Attaching it anyway could put the paid plan on the wrong account.

The card was still charged. The subscription existed on the provider side, and the account stayed on the free plan.

What was added after

The refusal stays.…