A dental membership where who is covered and who is paying stay the same list.

Customers get the membership with their product subscription, either free or at $20 a month, and it is fulfilled by a third-party provider, Careington. Nothing connected subscription billing in Recharge to the provider's member records. Enrolments and cancellations were handled by hand, so there was no reliable way to confirm that the people being covered were the people actually paying, and nothing clean to reconcile against.

Ticking the membership box on the product page adds it to the cart at Add to cart, and it comes out again if the product it came with leaves the cart. Anyone already subscribed never sees the offer. Members manage their plan in a Dental Portal inside their account, including their dental profile and cancellation. After checkout, a reminder on the Thank You and order status pages asks buyers to finish their dental profile, and follow-up emails chase anyone who does not. Customer Service get a Cancel Dental VIP button on the customer page in the Shopify admin, which makes all four of a cancellation's writes in one action.

A Node service on Railway between Shopify, Recharge and Careington. It generates the provider's eligibility file in their 29-field format, validates it before anything leaves, assigns each member to the right billing group, and delivers it automatically over SFTP. Effective and term dates are set to the first of the month so their billing cycle lines up with ours. Cancellations run off a single Recharge webhook: it sets the term date, tags the customer record, logs the reason, and only ends dental access once the customer has no qualifying subscription left. Order data flows into Google Sheets for reporting, and members see their own status in a customer portal.

Members in one group pay nothing for the membership while they hold another PuurSmile subscription, active or paused, and move to the $20 plan when the last one ends. Rather than reacting to each event, the price is worked out from the member's current subscriptions, on every webhook and again on a schedule, so a missed webhook costs a delay rather than a wrong charge. The other group's price never moves, because the two groups run side by side as an A/B test.

Something I caught mid-build. The provider's full-file format cancels anyone who is not listed in it, so sending an incomplete file would have terminated around 22,000 existing members in a single upload. I flagged it early and built the safeguards around it before it could ever reach production. Every file is now checked against the provider's eligibility guide before it is sent, and any error stops the upload.

Every member's status now traces back to an actual billing event instead of someone updating a spreadsheet. Enrolment, renewal and cancellation are one path rather than three manual ones, and the file the provider receives is checked before it is sent rather than after something goes wrong.

I built the app, the theme work and the pipeline. A second developer joined in September for the later hardening of the Recharge webhooks.