Next.js integration - Zahlo Merchant Developer Docs

Create checkout sessions in a Route Handler or server action. Return a narrow DTO containing the session ID, client token, checkout URL, and expiry; never serialize the merchant API key into a client component.

Route Handler

export async function POST(request: Request) {
  const order = await resolveOrder(await request.json());
  const response = await fetch("https://merchant-demo.zahlo.eu/api/v1/checkout-sessions", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": process.env.ZAHLO_API_KEY!,
      "Idempotency-Key": `checkout-${order.id}`,
    },
    body: JSON.stringify({
      mode: "embedded",
      amountMinor: order.totalMinor,
      currency: order.currency,
      orderId: order.id,
      allowedOrigins: ["https://store.example"],
    }),
  });
  return Response.json(await response.json(), { status: response.status });
}

Client component

Load the SDK in a client component, mount after the server response, and destroy it on unmount. Set Cache-Control: no-store on token responses and do not put them in a permanent cache, URL, analytics event, or error message.

Webhooks

Handle signed events in a Route Handler that reads the raw body. Keep webhook fulfillment independent of the browser component and use a durable store for event IDs.