The client sets the price, role, or plan in Stripe

const prices = {
  pro: process.env.STRIPE_PRICE_PRO!,
} as const;

export async function POST() {
  const user = await getCurrentUser();
  if (!user) return new Response("Unauthorized", { status: 401 });

  const session = await stripe.checkout.sessions.create({
    mode: "subscription",
    line_items: [{ price: prices.pro, quantity: 1 }],
    success_url: "https://your-app.example/account",
    cancel_url: "https://your-app.example/pricing",
    client_reference_id: user.id,
  });
  return Response.json({ url: session.url });
}

The price id lives in the server environment or a server-side map. Quantity, if the user may choose it, is checked against a range you set. The webhook handler, after constructEvent, writes the plan. The success page only displays status it reads from your database.