Polygon USDC subscriptions for recurring crypto billing with wallet checkout

A wallet may display several assets named USDC, including bridged variants. A ticker alone cannot establish eligibility. The checkout must match Polygon chain ID, the allowlisted USDC token address, token decimals and the subscription contract, rather than accepting any asset with the same symbol.

If the payer has USDC on another network, that balance does not automatically pay a Polygon invoice. Do not bridge or swap it silently. Explain the unsupported balance and allow the payer to choose another supported method when one is genuinely available.

For a planned 100 USDC charge during Free, the platform fee is 0 USDC: the customer pays 100 USDC, the merchant receives 100 USDC. Only after explicit activation and fresh consent would the future 1% fee produce 99.00 USDC merchant net and 1.00 USDC platform fee. There is no fixed platform fee per charge. The wallet may also need Polygon's native gas token, which is separate from the subscription price.

A quote must state the total token debit, the merchant's net proceeds and the network-gas estimate before the wallet asks for approval. If funds or gas are insufficient, payment must remain unavailable rather than showing an optimistic success state.

A monthly plan must show the billing interval, the next renewal and a cancellation path. Automatic collection is not guaranteed by a token allowance alone: the deployed contract, valid customer consent and an authorized execution mechanism must all support the renewal. Otherwise a new wallet action may be required.

Changing the amount, fee recipient or other signed terms should require fresh consent. A cancelled or revoked authorization must not be silently reused; already-settled transfers are not reversed merely because a future renewal was cancelled.

An unsigned checkout draft is not permission to charge a wallet. Before asking for a signature, a trusted server must bind the quote to the payer, merchant, exact Polygon token contract, subscription contract, plan, amount and the platform's authorized fee recipient. A different fee-recipient address, even a valid-looking wallet address, is a reason to stop and investigate rather than silently redirect any future platform share.

For example, on a hypothetical 50 USDC Free invoice, the platform fee is 0 USDC and the merchant receives 50 USDC, excluding separate Polygon gas. After explicit activation, a 1% merchant-funded fee would mean 0.50 USDC for the platform and 49.50 USDC merchant net. Free consent must cap the platform fee at exactly 0 basis points; future 100-bps consent must be separately obtained, never inferred from old 100-, 150- or 500-bps approvals. A new fee policy or treasury address requires a new, clearly disclosed authorization; an old signature must not be repurposed.

This signed-quote safety policy is currently exercised by offline V5 fixtures. It is not a claim that a live multichain signer, audited contract deployment or automatic renewal executor exists. A merchant should grant access only after independently verified final settlement, not after receiving an unsigned quote or a wallet popup.

Signer rotation is a separate security event from changing the fee treasury. The contract's current quote signer must match the server-authorized signer before any checkout handoff; a syntactically valid but unrecognized signer must block the flow. A signed quote also has a strict expiry: a transaction included exactly at the deadline is too late, even if the wallet originally approved it. The customer should see an expired quote and request a fresh one, never a paid receipt. These are local V5 safety requirements, not claims of live signing infrastructure.

A merchant should wait for a canonical transaction receipt and the expected contract event, checking payer, merchant, token, amount and payment reference. A transaction hash or client callback alone cannot justify a final receipt. Confirmations and chain finality must be checked according to the supported network policy.

Retries must be idempotent: a delayed transaction must not trigger a second charge. If a reorganization invalidates earlier evidence, the subscription enters review rather than keeping a false paid state. The V5 multichain verifier currently exercises these rules with offline fixtures and is not a live Polygon/Base/Arbitrum deployment.