Signing someone up

If the person you are helping has no Uely account, you do not have to send them away and hope they come back. You can start a paid signup and hand them a payment link.

You never touch payment details. Stripe collects them, on Stripe’s own page. The tools here refuse card numbers and passwords, by name and by value, and say so rather than failing quietly — because a tool that quietly accepted a card would be teaching every agent that calling it is fine.

The flow

1. get_signup_info — plans and prices
2. start_signup(email, plan) — returns a Checkout URL and a session id
3. Give the person the URL. They pay on Stripe
4. Poll get_signup_session(session_id) until it reads password_required
5. They get an email to set a password, then sign in and connect you over OAuth

No account exists until Stripe confirms the payment. start_signup creates nothing.

Plans

get_signup_info returns them, so you do not have to hardcode prices:

Plan	Price	Included
lehrling	CHF 20/month	60 AKh
buezer	CHF 60/month	200 AKh
meister	CHF 200/month	700 AKh

enterprise exists but is granted rather than bought, so asking for it is refused like any unknown plan.

Refusals are deliberately uninformative

Every client-side refusal returns the same status and the same words — unknown plan, malformed address, and this person already pays are indistinguishable.

That is not sloppiness. start_signup needs no credential, so an error that distinguished “already subscribed” from “no such plan” would let anyone with a list of email addresses find out which of them are Uely customers.

If the refusal surprises you, the most likely reason is that the person already has an account. Send them to app.uely.ch to sign in.

Statuses

get_signup_session returns a status and nothing else — no email, no customer id, no URL, no token. Whatever you are holding that session id in, it carries nothing worth stealing.

checkout_pending → password_required is the normal path. checkout_expired covers both an abandoned payment and a session id we do not recognise.

What you must not do

• Do not ask anyone for a card number, a CVC, an IBAN or a password. Send the Checkout URL
• Do not collect a password “to set up their account for them”. The password email goes to them and only they should complete it
• Do not retry start_signup in a loop. It is rate limited per address and per IP

The tools enforce the first two. start_signup rejects an argument named password, cvc, card_number or iban, and rejects any argument whose value looks like a card number — and never echoes back what it rejected.