--- a/src/app/api/checkout/route.ts
+++ b/src/app/api/checkout/route.ts
@@ -7,6 +7,8 @@
 
 export const dynamic = "force-dynamic";
 
+const BYPASS_PAYMENTS = process.env.BYPASS_PAYMENTS === "true";
+
 export async function POST(req: Request) {
   // Each checkout hits the payment provider, so cap order creation per user
   // and per IP to prevent order spam and provider-API abuse.
@@ -86,6 +88,20 @@
     const paid = await prisma.order.findUnique({
       where: { id: order.id },
       include: { license: true },
+    });
+    return NextResponse.json({
+      ok: true,
+      orderId: order.id,
+      licenseKey: paid?.license?.key ?? null,
+      tier: tier.slug,
+    });
+  }
+
+  if (BYPASS_PAYMENTS) {
+    await markOrderPaid({ orderId: order.id, providerRef: "bypass-test" });
+    const paid = await prisma.order.findUnique({
+      where: { id: order.id },
+      include: { license: true },
     });
     return NextResponse.json({
       ok: true,