Server builds, wallet signs, webhooks confirm — a non-custodial Web3 checkout pattern with Solana

I've been building a Solana checkout flow. The core challenge: the server needs to control the terms of every payment — the amount, the recipient, the audit trail — without ever holding a private key. This post documents the pattern I landed on: Checkout session with TTL and CSRF protection Atomic token invalidation to prevent TOCTOU race conditions A server-side pending record (similar to Stripe's Payment Intent) written before the wallet is ever involved Webhook authentication and idempotent c