# Sell inside your App

URL: /products/app/sell · Id: `page:products/app/sell`

> How a Customer's plan shapes every screen and call of an App, and where the Customer pays, upgrades and cancels.

Your [App](/business/nouns/app) reads each [Customer](/business/nouns/customer)'s plan before every screen and every call. Lock a feature, cap a count or charge per person on the [Offer](/business/nouns/offer), and the buttons, limits and invoices follow.

## What a plan controls
Every row comes from the Offer the Customer holds. You write no gating code for any of them.

| The customer has | The App shows | It comes from |
| --- | --- | --- |
| A feature on a higher plan | The button, with a lock and the plan that unlocks it | An [Entitlement](/business/nouns/entitlement) with no [Limit](/business/nouns/limit) |
| A capped feature | A usage bar, then the upgrade offer at the cap | An Entitlement with a Limit, and the Offer's `atBound` |
| A per-seat plan | Seats used and paid, on the members screen | The Offer's `seats` |
| A trial | Days left, and a button to add a card | The Offer's `trial` |
| A failed renewal | A banner to update the card; everything still works | A [Subscription](/business/nouns/subscription) in `pastDue` |

The same answer reaches the API and the MCP server, so an agent calling your App meets the same plan as a person clicking it. [Checking access](/products/offers/checking-access) covers the check itself.

## Lock a feature, cap a count
A feature is a [Verb](/business/nouns/verb) the plan grants. To lock CSV export to `pro`, grant [`Collection.export`](/business/nouns/collection/export) on that Offer with [`Offer.grant`](/business/nouns/offer/grant), and leave it off `free`.

Show the locked button; never hide it. A locked button with the plan name on it is the cheapest upgrade prompt you have.

A cap is the same grant with a Limit. Leaseline's `free` plan covers 20 units with `atBound: upgrade`, so the 21st unit offers `pro` instead of failing. Cap what costs you money, and leave the rest unlimited.

## Seats
A per-seat [Price](/business/nouns/price) counts people. The Offer's `seats` says how.

| `seats` | How the count moves | Use it for |
| --- | --- | --- |
| `members` | Follows the people in the Customer's [Tenant](/business/nouns/tenant): an invite adds a seat and prorates it in | Small groups that add people as they grow |
| `manual` | The buyer sets the quantity; an invite past it asks an admin to buy a seat | Buyers who budget by headcount |

Charge per seat only when each extra person gets value of their own. Leaseline prices by units managed, not people, because one manager runs 200 units alone.

## Billing inside the App
The Tenant's `owner` pays, upgrades and cancels from the [billing portal](/systems/finance/billing-portal) at `leaseline.app/portal/billing`, under Leaseline's [Brand](/business/nouns/brand). A card is entered on that page, so no step leaves the [Startup](/business/nouns/startup)'s [Domain](/business/nouns/domain).

| Move | Access | Money |
| --- | --- | --- |
| Upgrade | The new grants work on the next call | The prorated difference, charged at once |
| Downgrade | Keeps the higher plan to the end of the period | The lower amount from the next period |
| Cancel | Full access until the period closes | Nothing more |
| A failed charge | Full access while retries run | Retried on the [dunning](/workflows/processes/billing/dunning) schedule |

Cancelling takes no more steps than buying did. A plan change never deletes a record: past a new cap, existing records stay readable and only new writes stop.

## Next
- [Charge per seat](/products/app/charge-per-seat), [lock a feature to a plan](/products/offers/lock-a-feature-to-a-plan) or [cap usage on a plan](/products/offers/cap-usage-on-a-plan): the asks.
- [Anatomy of an Offer](/products/offers/anatomy): every field an Offer holds.