Booking & Payments

1---
2name: launch-booking-payments
3description: >
4  Let a small business's customers book a time and pay online without a phone call, and keep
5  every booking and payment in sync with the lead. Use this skill for appointment booking,
6  scheduling embeds, Cal.com, deposits, Stripe Checkout, Payment Links, no-show protection,
7  booking and payment webhooks, and when the user mentions "let customers book online",
8  "take a deposit", "sell a package", or booking conversion.
9---
10
11# Booking and Payments: Book and Pay Without a Phone Call
12
13**RULE: The server decides what a customer pays, and a verified webhook decides that they
14paid or booked. Never trust a price, amount or "success" that comes from the browser.**
15
16## 1. Pick the right action for the business
17
18| Business | Main action | Tool |
19|---|---|---|
20| Fixed-length appointments (salon, clinic, consultant, lessons) | Book a time | Cal.com (embed or link) |
21| Appointments with no-show risk | Book a time + deposit | Cal.com with Stripe payment, or Stripe Checkout then booking |
22| Jobs that need a look first (trades, renovations) | Request a quote | Form (`launch-lead-capture`), then book a visit |
23| Fixed-price products or packages | Pay now | Stripe Checkout or Payment Links |
24| Recurring service (cleaning, lawn care, memberships) | Subscribe | Stripe Checkout in `subscription` mode |
25
26Do not force booking on a business that must quote first. A calendar that offers slots the
27owner cannot keep creates angry customers.
28
29## 2. Booking with Cal.com
30
31- **Embed inline on the page** for the highest completion; a pop-up is fine on a busy page.
32  A plain link to the Cal.com page works when an embed is not possible.
33- **Prefill** name and email when the visitor came from a lead form, so they do not type twice.
34- **Pass attribution** in metadata (UTM source and campaign, the lead id) so the booking
35  links back to the lead and the channel.
36- Ask only the questions the appointment needs. Add buffer times and a minimum notice period
37  so the owner is not surprised by a booking in 20 minutes.
38- Send reminders 24 hours and 2 hours before. Reminders cut no-shows more than anything else.
39
40### Verify the webhook, then update the lead
41
42Cal.com signs the raw body with the webhook secret (HMAC SHA-256, hex) in the
43`x-cal-signature-256` header.
44
45```ts
46// app/api/webhooks/cal/route.ts
47import { createHmac, timingSafeEqual } from "node:crypto"
48import { z } from "zod"
49
50import { markBookingCancelled, markBookingRescheduled, markLeadBooked } from "@/lib/leads"
51
52// Only the fields this route uses. Unknown fields are ignored.
53const calEvent = z.object({
54  triggerEvent: z.string(),
55  payload: z.object({
56    uid: z.string().min(1),
57    rescheduleUid: z.string().min(1).optional(),
58    startTime: z.string().optional(),
59    attendees: z.array(z.object({ email: z.string() })).default([]),
60    metadata: z.object({ leadId: z.string().optional() }).optional(),