How to implement in a safe way paid features using ExtPay

[realrecordzLab]

I saw in the last release of this great repo that there is the ability to use ExtPay to add the ability to let user pay for extension features. My doubt is about implementation of the pad features, the chrome extension code is visible to users so my question is, what is the better way to add a paid feature into the build without the risk that the extension code can be hacked to bypass the check of the subscription?

[mubaidr]

This is very common issue/ concern with the chrome extension Deveopment, here is a quick guideline:

• Server-Side Validation: Always verify the subscription status on your backend. The extension should only send a token or user ID to the backend, which validates the subscription using ExtPay's API and returns the result.
• Minimal Exposure in Extension Code: Avoid storing sensitive logic or subscription checks directly in the extension. Use backend API calls to gate access to features or content.
• Obfuscation: While not foolproof, obfuscating the extension code can make it harder for users to bypass checks.
• Feature Gating: Deliver paid features dynamically from your backend (e.g., feature toggles or restricted APIs). If the subscription isn’t valid, the feature won’t be accessible.
• Audits and Monitoring: Monitor usage patterns or unauthorized access attempts through logging in your backend.

By offloading critical logic to the backend, you reduce the risk of hacking significantly.