Best way to take payments in a vibe-coded app: Polar vs Lemon Squeezy

Who this is for: your app works, usually built with AI, and you’re ready to charge for something: a template, a guide, lifetime access. You want a checkout page you don’t have to build, a reliable signal when someone has paid, and someone else dealing with sales tax.

Our pick: Polar (91/100). Every step worked through its API: creating the product, the checkout link and the webhook, then looking up the order. That matters if an AI agent is wiring up payments for you. Its webhooks are signed with a timestamp, its SDK verifies them in one call, its API keys can be scoped and set to expire, and its sandbox runs on separate servers from live money.

Runner-up: Lemon Squeezy (87/100). It passed the same checks: hosted checkout, test purchase, signed webhook, order lookup. Its fee is the same. It lost points because you have to create products in its dashboard, its webhook signature doesn’t include a timestamp, and its docs don’t offer scoped API keys.

It’s close. Both tools scored the same on both runs, 4 points apart. That’s under our 5-point line, so the tie-breaker decided it. Fees on a $24 sale are identical, so it came down to safe defaults, where Polar scored higher. Both are merchants of record, which means they resell your product and handle sales tax for you.

Gotchas

Both: neither charged our Ontario buyer any tax. Our test buyer in Toronto paid $24 with $0 tax on both tools, in both runs. Lemon Squeezy’s order even names the tax (HST) at a rate of 0. Neither vendor’s docs explain it. Polar’s sandbox did charge tax for Sweden, the UK and New York. Before you launch, run a test checkout with your main customers’ addresses.

Lemon Squeezy: check your store currency. We chose Canada as the store’s country at signup, and the store currency quietly defaulted to Canadian dollars, so our “$24” product was CA$24.00 (about US$16.96). If you want to charge in US dollars, change the currency on purpose before you create products.

Lemon Squeezy: guard against replayed webhooks. Its X-Signature signs only the body, not the time it was sent. Someone who captures a real webhook could send it again later and it would still verify. Store each event’s ID and ignore repeats.

Lemon Squeezy: you can’t create products through the API. Checkouts, webhooks and orders work through the API, but products and prices need the dashboard. Its webhook signing secret is limited to 40 characters (a clear error told us).

Polar: in some countries tax comes out of your price. For Swedish and UK buyers, the sandbox kept the price at $24 and took the VAT out of it ($4.80 and $4.00). For New York it added $2.13 on top. Polar lets you choose tax-inclusive or tax-exclusive pricing; decide on purpose.

Both: getting paid takes verification. Polar needs an account review (up to 14 days), an ID check and a Stripe payout account with a bank account in your business’s country. Lemon Squeezy pays out to a bank or a verified PayPal account and may ask you to verify your identity. You can build and test with either right away.

Both: verify the raw body. Signature checks only work on the exact bytes that were sent. If your framework parses the JSON first, verification fails.

Scores

Scored with our published rubric. Tested 2026-10-16. Both tools scored the same on both runs.

Scroll sideways for more columns →

The 8 checks: product at 24.00 in the store currency, hosted checkout link made through the API, test purchase with the test card, signed webhook verified, forged webhook rejected, order found through the API, sales tax collected for an Ontario buyer, and test key unable to reach live mode.

What it costs

The tests cost $0 on sandbox and test accounts, with no card on file. Real sales cost this (checked 2026-10-16):

Scroll sideways for more columns →

Both take the fee on the total, including any tax. A payment processor like Stripe leaves sales tax registration and filing to you. We haven’t tested it yet.

Caveats

• Sandbox and test mode, not live. No real money moved. Tax and fees may behave differently in live mode. Polar’s fee in our sandbox orders matched its published Starter rate. Lemon Squeezy’s orders don’t show a fee, so its numbers come from its pricing page.
• Different currencies. Polar charged US$24.00. Our Lemon Squeezy store was in Canadian dollars, so it charged CA$24.00. Neither affects the checks.
• Lemon Squeezy’s product was made by a person in its dashboard, because its API can’t create one. That counts as one manual step. Both of its runs used that same product.
• Order matters. Polar ran first, and its script fixes carried over to the Lemon Squeezy runs.
• Webhook receiver. Our box can’t accept incoming connections, so webhooks went to a tiny function that stored them unchanged. We checked the signatures on the box afterwards with each endpoint’s secret.
• Headless checkout. We paid on each vendor’s real hosted checkout with Playwright. Failed first attempts were our own script’s fault; details are in the test script’s amendments.
• No login in the test app. Tie each purchase to a signed-in user before you launch: see adding login to your app.
• Runs were done by an AI agent following vendor docs only. The check script is public.

Next step: store who paid. Save each verified order against the buyer’s account: see our tested pick for a database for your vibe-coded app.

Before you launch: check your app’s security. See our vibe coding security check.

Send receipts and order emails from your own domain with our tested pick for sending emails from your app.

Not tested yet

• Stripe. We don’t have a Stripe account of our own yet.
• Paddle. Signup asks for a business address we don’t have yet.

This page has no affiliate links yet. Every link goes to the tool’s own homepage. Affiliate deals never decide a pick, and a tool with no affiliate program can still win. How we make money.