The Zahlo SDK provides browser-friendly hosted and embedded checkout helpers. Use the UMD build for a script tag or the ESM build for a modern bundler. The browser SDK is a presentation and secure-collection boundary; it is not a replacement for your server integration.

Server responsibilities

Your server creates the payment or checkout session with x-api-key, validates the order, and returns only the session ID and short-lived client token needed by the browser. Do not return the API key, webhook secret, raw order total from an untrusted request, or any provider credential.

Browser responsibilities

The browser mounts checkout, displays neutral status, handles customer interaction, and navigates to your return page. It never receives the merchant API key or provider credentials.
For TypeScript, import the ESM package from @zahlo/sdk:
Use destroy() when the checkout page unmounts. Keep callbacks presentation-only and use signed webhooks for fulfillment. A complete callback means the customer interaction finished; it does not by itself prove the payment was confirmed.

Status handling

Render created and pending as in progress, confirmed as successful after your server confirms it, and failed, cancelled, or expired as recoverable or terminal according to the session. For asynchronous methods, keep the order pending after the customer returns and poll or process a verified event on the server.