diff --git a/apps/labrinth/src/routes/internal/billing.rs b/apps/labrinth/src/routes/internal/billing.rs
index 606c96b7..43e6d36b 100644
--- a/apps/labrinth/src/routes/internal/billing.rs
+++ b/apps/labrinth/src/routes/internal/billing.rs
@@ -711,6 +711,14 @@ pub async fn edit_subscription(
                     }));
                 }
 
+                let payment_request_type =
+                    PaymentRequestType::from_stripe_id(payment_method)
+                        .ok_or_else(|| {
+                            ApiError::InvalidInput(
+                                "Invalid payment method ID".to_owned(),
+                            )
+                        })?;
+
                 if req == PaymentRequirement::RequiresPayment {
                     let results = create_or_update_payment_intent(
                         &pool,
@@ -721,10 +729,7 @@ pub async fn edit_subscription(
                             user: &user,
                             payment_intent: None,
                             payment_session: PaymentSession::Interactive {
-                                payment_request_type:
-                                    PaymentRequestType::PaymentMethod {
-                                        id: payment_method,
-                                    },
+                                payment_request_type,
                             },
                             attached_charge: AttachedCharge::Promotion {
                                 product_id: new_product_price.product_id.into(),
@@ -1293,6 +1298,19 @@ pub enum PaymentRequestType {
     ConfirmationToken { token: String },
 }
 
+impl PaymentRequestType {
+    pub fn from_stripe_id(id: String) -> Option<Self> {
+        let prefix = id.split_at(id.split_once('_')?.0.len() + 1).0;
+        if stripe::PaymentMethodId::is_valid_prefix(prefix) {
+            Some(Self::PaymentMethod { id })
+        } else if prefix == "ctoken_" {
+            Some(Self::ConfirmationToken { token: id })
+        } else {
+            None
+        }
+    }
+}
+
 #[derive(Deserialize)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum ChargeRequestType {