Significant-Gravitas/AutoGPT · warning · HTTPException

success_url and cancel_url are required for paid tier upgrad

Error message

success_url and cancel_url are required for paid tier upgrades

What it means

HTTP 422 from POST /credits/subscription when the user has no active Stripe subscription (so a new Checkout Session must be created) but the request omits success_url or cancel_url. The Stripe Checkout flow needs both redirect targets; without an existing subscription to modify, they are mandatory.

Source

Thrown at autogpt_platform/backend/backend/api/features/v1.py:1297

                "Unable to update your subscription right now. "
                "Please try again or contact support."
            ),
        )
    except stripe.StripeError as e:
        logger.exception(
            "Stripe error modifying subscription for user %s: %s", user_id, e
        )
        raise HTTPException(
            status_code=502,
            detail=(
                "Unable to update your subscription right now. "
                "Please try again or contact support."
            ),
        )

    # No active Stripe subscription → create Stripe Checkout Session.
    if not request.success_url or not request.cancel_url:
        raise HTTPException(
            status_code=422,
            detail="success_url and cancel_url are required for paid tier upgrades",
        )
    # Open-redirect protection: both URLs must point to the configured frontend
    # origin, otherwise an attacker could use our Stripe integration as a
    # redirector to arbitrary phishing sites.
    #
    # Fail early with a clear 503 if the server is misconfigured (neither
    # frontend_base_url nor platform_base_url set), so operators get an
    # actionable error instead of the misleading "must match the platform
    # frontend origin" 422 that _validate_checkout_redirect_url would otherwise
    # produce when `allowed` is empty.
    if not (settings.config.frontend_base_url or settings.config.platform_base_url):
        logger.error(
            "update_subscription_tier: neither frontend_base_url nor "
            "platform_base_url is configured; cannot validate checkout redirect URLs"
        )
        raise HTTPException(

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Include both success_url and cancel_url in the request body for new paid-tier checkouts
2. Both URLs must also point at the configured frontend origin or they fail the open-redirect check
3. Ensure the server has frontend_base_url/platform_base_url configured so the origin allow-list is populated

Example fix

// before
{ tier: "PRO", billing_cycle: "monthly" }

// after
{
  tier: "PRO",
  billing_cycle: "monthly",
  success_url: "https://app.example.com/billing/success",
  cancel_url: "https://app.example.com/billing"
}

const status = await api.getSubscriptionStatus();
const needsCheckout = !status.hasActiveStripeSubscription;
if (needsCheckout && (!successUrl || !cancelUrl)) throw new Error("success_url and cancel_url required");

function isValidCheckoutRequest(r: SubscriptionRequest, hasActiveSub: boolean): boolean {
  return !hasActiveSub || Boolean(r.success_url && r.cancel_url);
}

When it happens

Trigger: First-time upgrade request (no active subscription) with request body lacking success_url and/or cancel_url, or either being an empty string.

Common situations: Frontend sending only success_url for a 'one-way' upgrade; API clients copying the modify-in-place request shape; empty-string defaults from form state; older clients predating the required field.

Related errors

• Tier change unavailable for your current billing currency. P
• success_url and cancel_url must match the platform frontend
• Server returned ${status}.
• Stripe didn't return a checkout URL. Check backend logs for
• Page must be greater than 0

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/8bb90f9fd338a4a8. Report an issue: GitHub.