Project architecture sanity check

My app is quite simple. I want a react app front end where the user can:

sign up
login
logout
change email
change password
forgot password

subscribe to pay $ per month via stripe integration

I know when it comes to stripe you guys have a great tutorial https://appwrite.io/docs/tutorials/subscriptions-with-stripe/step-1

i know that i need to have stripe secrets in a appwrite function to create a checkout session and all that

So in my head i have the following

react app hosted on vercel - is has the appwrite js sdk https://github.com/appwrite/sdk-for-web

the react app will need to call my appwrite function to generate a stripe checkout session to do the needed stripe stuff

My concern is that since appwrite functions are open to the world that anyone could generate a checkout session or what not - in a perfect world i only want my appwrite function to be callable from my website

Why do you care if someone gives you more money?

But anyway, you can set your Function Permissions to only allow logged in users. Though of course, anyone can create a user

i think the idea of back charges

i dunno - i guess im paranoid

each charg back is $15

one more question - @ideclon when it comes to dev / staging / prod - is it suggested to have three different projects entirely ?