Server responsibilities
Your server creates the payment or checkout session withx-api-key, validates the order, and returns only the session ID and short-lived client token needed by the browser. Do not return the API key, webhook secret, raw order total from an untrusted request, or any provider credential.
Browser responsibilities
The browser mounts checkout, displays neutral status, handles customer interaction, and navigates to your return page. It never receives the merchant API key or provider credentials.@zahlo/sdk:
destroy() when the checkout page unmounts. Keep callbacks presentation-only and use signed webhooks for fulfillment. A complete callback means the customer interaction finished; it does not by itself prove the payment was confirmed.
Status handling
Rendercreated and pending as in progress, confirmed as successful after your server confirms it, and failed, cancelled, or expired as recoverable or terminal according to the session. For asynchronous methods, keep the order pending after the customer returns and poll or process a verified event on the server.