Why Sheque Checkout Totals Come From the Server

On Sheque — a multi-vendor platform with Next.js 15 and NestJS — checkout was the part I paid the most attention to. You have multiple vendors, different pricing rules, tax by region, coupons, and inventory that can change between "Add to cart" and "Pay." If the frontend sends a total and the backend trusts it, someone will eventually send a lower number. That's not an edge case — it's how the web works.

So checkout is server-authoritative. The client sends what the user wants to buy — cart, address, payment method — not the amount. NestJS recalculates line items, applies vendor rules, calls TaxCloud for tax, then creates the Stripe PaymentIntent from that number. PostgreSQL holds the source of truth through Prisma. If stock runs out or a coupon expires mid-checkout, the server response wins.

It took more backend work up front, but payment reconciliation got simpler and we had fewer surprises in production. As a full-stack dev on the project, I wanted the money path to be as solid as the storefront UI. The cart can look great — the server still owns the total.