Missing session.
; const { order, paid } = await orderForSuccessPage(sessionId); if (!order) returnOrder not found.
; return paid ? (Thank you! Order {order.id} is paid.
) : ( // The webhook usually arrives within seconds; reload to check again.Payment processing. Order {order.id} will be confirmed by email.
); } ```{error}
}Missing session.
; const { order, paid } = await orderForSuccessPage(sessionId); if (!order) returnOrder not found.
; return paid ? (Thank you! Order {order.id} is paid.
) : ( // The webhook usually arrives within seconds; reload to check again.Payment processing. Order {order.id} will be confirmed by email.
); } ```Order not found.
'; } elseif ($order['status'] === 'paid') { echo 'Thank you! Order ' . htmlspecialchars($order['id']) . ' is paid.
'; } else { // The webhook usually arrives within seconds; reload to check again. echo 'Payment processing. Order ' . htmlspecialchars($order['id']) . ' will be confirmed by email.
'; } ```Missing session.
"); const session = await zahlo("GET", `/checkout-sessions/${encodeURIComponent(sessionId)}`); const order = db.prepare("SELECT * FROM orders WHERE session_id = ?").get(session.id); if (!order) return send(response, 200, "Order not found.
"); return send( response, 200, order.status === "paid" ? `Thank you! Order ${escapeHtml(order.id)} is paid.
` : // The webhook usually arrives within seconds; reload to check again. `Payment processing. Order ${escapeHtml(order.id)} will be confirmed by email.
` ); } if (route === "POST /webhooks/zahlo") { // 1. Verify the signature on the raw body before trusting anything in it. const rawBody = (await readBody(request)).toString("utf8"); const event = verifyZahloEvent(rawBody, request.headers["zahlo-signature"] ?? null, webhookSecret); if (!event) return send(response, 400, "Invalid signature"); // 2. Re-fetch the object and act on its current state, so a late, older event cannot undo a newer one. const id = encodeURIComponent(event.data.object.id); let apply = () => {}; if (event.type === "checkout.session.completed" || event.type === "checkout.session.expired") { const session = await zahlo("GET", `/checkout-sessions/${id}`); apply = () => { if (session.paymentStatus === "paid") { const paid = db .prepare("UPDATE orders SET status = 'paid', payment_id = ? WHERE session_id = ? AND status = 'pending'") .run(session.paymentId, session.id); if (paid.changes === 1) { db.prepare("INSERT OR IGNORE INTO jobs (kind, order_id) VALUES ('confirmation_email', ?)").run( session.reference ); } } else if (session.status === "expired") { db.prepare("UPDATE orders SET status = 'expired' WHERE session_id = ? AND status = 'pending'").run(session.id); } }; } else if (event.type === "refund.succeeded") { const refund = await zahlo("GET", `/refunds/${id}`); apply = () => { if (refund.status === "succeeded") { db.prepare("UPDATE orders SET status = 'refunded' WHERE payment_id = ?").run(refund.paymentId); } }; } else if (event.type === "dispute.created") { const dispute = await zahlo("GET", `/disputes/${id}`); apply = () => { // Hold the shipment and answer the dispute in the dashboard. db.prepare("UPDATE orders SET status = 'disputed' WHERE payment_id = ? AND status = 'paid'").run( dispute.paymentId ); }; } // 3. Record the event and apply the change in ONE transaction, and answer 2xx only after it commits. // A crash before the commit rolls back both, so Zahlo's retry does the work again. transaction(() => { const fresh = db .prepare("INSERT INTO processed_events (event_id) VALUES (?) ON CONFLICT DO NOTHING") .run(event.id); if (fresh.changes === 1) apply(); }); return send(response, 200, "ok"); } return send(response, 404, "Not found"); } createServer((request, response) => { handle(request, response).catch((error) => { console.error("request failed", error); if (!response.headersSent) send(response, 500, "Internal error"); }); }).listen(port, () => console.log(`Listening on ${siteUrl}`)); ``` ```html public/index.htmlOrder not found.
'; } elseif ($order['status'] === 'paid') { echo 'Thank you! Order ' . htmlspecialchars($order['id']) . ' is paid.
'; } else { // The webhook usually arrives within seconds; reload to check again. echo 'Payment processing. Order ' . htmlspecialchars($order['id']) . ' will be confirmed by email.
'; } ```Missing session.
"); const session = await zahlo("GET", `/checkout-sessions/${encodeURIComponent(sessionId)}`); const order = db.prepare("SELECT * FROM orders WHERE session_id = ?").get(session.id); if (!order) return send(response, 200, "Order not found.
"); return send( response, 200, order.status === "paid" ? `Thank you! Order ${escapeHtml(order.id)} is paid.
` : // The webhook usually arrives within seconds; reload to check again. `Payment processing. Order ${escapeHtml(order.id)} will be confirmed by email.
` ); } if (route === "POST /webhooks/zahlo") { // 1. Verify the signature on the raw body before trusting anything in it. const rawBody = (await readBody(request)).toString("utf8"); const event = verifyZahloEvent(rawBody, request.headers["zahlo-signature"] ?? null, webhookSecret); if (!event) return send(response, 400, "Invalid signature"); // 2. Re-fetch the object and act on its current state, so a late, older event cannot undo a newer one. const id = encodeURIComponent(event.data.object.id); let apply = () => {}; if (event.type === "checkout.session.completed" || event.type === "checkout.session.expired") { const session = await zahlo("GET", `/checkout-sessions/${id}`); apply = () => { if (session.paymentStatus === "paid") { const paid = db .prepare("UPDATE orders SET status = 'paid', payment_id = ? WHERE session_id = ? AND status = 'pending'") .run(session.paymentId, session.id); if (paid.changes === 1) { db.prepare("INSERT OR IGNORE INTO jobs (kind, order_id) VALUES ('confirmation_email', ?)").run( session.reference ); } } else if (session.status === "expired") { db.prepare("UPDATE orders SET status = 'expired' WHERE session_id = ? AND status = 'pending'").run(session.id); } }; } else if (event.type === "refund.succeeded") { const refund = await zahlo("GET", `/refunds/${id}`); apply = () => { if (refund.status === "succeeded") { db.prepare("UPDATE orders SET status = 'refunded' WHERE payment_id = ?").run(refund.paymentId); } }; } else if (event.type === "dispute.created") { const dispute = await zahlo("GET", `/disputes/${id}`); apply = () => { // Hold the shipment and answer the dispute in the dashboard. db.prepare("UPDATE orders SET status = 'disputed' WHERE payment_id = ? AND status = 'paid'").run( dispute.paymentId ); }; } // 3. Record the event and apply the change in ONE transaction, and answer 2xx only after it commits. // A crash before the commit rolls back both, so Zahlo's retry does the work again. transaction(() => { const fresh = db .prepare("INSERT INTO processed_events (event_id) VALUES (?) ON CONFLICT DO NOTHING") .run(event.id); if (fresh.changes === 1) apply(); }); return send(response, 200, "ok"); } return send(response, 404, "Not found"); } createServer((request, response) => { handle(request, response).catch((error) => { console.error("request failed", error); if (!response.headersSent) send(response, 500, "Internal error"); }); }).listen(port, () => console.log(`Listening on ${siteUrl}`)); ``` The page loads the browser SDK and mounts the payment form. Its callbacks only change what the customer sees; the webhook fulfils the order. ```html public/pay.html{error}
}{user.subscription_id ? `Subscription ${user.subscription_status}. ` : "Start your 14-day free trial. "} Subscribe to Pro
); } ```Pro is active (). Welcome, .
'subscription', 'mode' => $mode, 'lineItems' => [['priceId' => $price['id'], 'quantity' => 1]], 'customerEmail' => $user['email'], 'reference' => $user['id'], 'successUrl' => site_url() . '/account.php?session_id={CHECKOUT_SESSION_ID}', 'cancelUrl' => site_url() . '/account.php', ]; if ($couponId !== null) { $body['couponId'] = $couponId; } // One key per attempt; a network retry inside zahlo() reuses it. return zahlo('POST', '/checkout-sessions', $body, 'subscribe-' . $user['id'] . '-' . bin2hex(random_bytes(8))); } /** Runs $respond with the new session; Zahlo errors become a 400 (bad request) or 502 (Zahlo unavailable). */ function subscribe_or_fail(string $mode, callable $respond): void { if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); exit; } $user = current_user(); if ($user === null) { http_response_code(401); header('content-type: application/json'); echo json_encode(['error' => ['message' => 'Sign in first']]); exit; } try { $respond(create_subscription_session($user, $mode)); } catch (ZahloError $error) { error_log("subscribe failed {$error->errorCode} {$error->requestId}"); http_response_code($error->status >= 500 ? 502 : 400); header('content-type: application/json'); echo json_encode(['error' => ['code' => $error->errorCode, 'message' => $error->getMessage()]]); } } ``` **Hosted checkout:** the server creates the session and redirects to its `url`. ```php subscribe.php zahlo_base(), 'clientToken' => $session['clientToken'], 'sessionId' => $session['id']]); }); ``` ```html subscribe.htmlPro is active (${escapeHtml(user.subscription_status)}). Welcome, ${escapeHtml(user.email)}.
`); } return send( response, 200, `` + `` ); } if (route === "GET /subscribe.html") return send(response, 200, await readFile(join(publicDir, "subscribe.html"))); // Hosted checkout: create the session on the server, then send the browser to session.url. if (route === "POST /subscribe") { const user = userFromRequest(request); if (!user) return send(response, 401, "Sign in first"); try { const promoCode = String((await readForm(request)).get("promoCode") ?? "").trim() || undefined; const session = await createSubscriptionSession(user, "hosted", promoCode); return send(response, 303, "", { location: session.url }); } catch (error) { return subscribeFailed(response, error); } } // Embedded checkout: return only the session id and its short-lived client token to the browser. if (route === "POST /subscribe-session") { const user = userFromRequest(request); if (!user) return sendJson(response, 401, { error: { message: "Sign in first" } }); try { const promoCode = String((await readForm(request)).get("promoCode") ?? "").trim() || undefined; const session = await createSubscriptionSession(user, "embedded", promoCode); return sendJson(response, 200, { apiUrl: apiBase, clientToken: session.clientToken, sessionId: session.id }); } catch (error) { return subscribeFailed(response, error); } } if (route === "POST /webhooks/zahlo") { // 1. Verify the signature on the raw body before trusting anything in it. const rawBody = (await readBody(request)).toString("utf8"); const event = verifyZahloEvent(rawBody, request.headers["zahlo-signature"] ?? null, webhookSecret); if (!event) return send(response, 400, "Invalid signature"); // 2. Re-fetch and store the subscription's current state; never apply the event payload, so events // arriving late or out of order cannot grant or revoke access wrongly. const id = encodeURIComponent(event.data.object.id); let apply = () => {}; if (event.type === "checkout.session.completed") { const session = await zahlo("GET", `/checkout-sessions/${id}`); if (session.type === "subscription" && session.status === "complete" && session.subscriptionId) { const subscription = await zahlo("GET", `/subscriptions/${encodeURIComponent(session.subscriptionId)}`); apply = () => saveSubscription(subscription, session.reference); } } else if (event.type.startsWith("subscription.")) { const subscription = await zahlo("GET", `/subscriptions/${id}`); apply = () => saveSubscription(subscription); } // 3. Record the event and apply the change in ONE transaction, and answer 2xx only after it commits. // A crash before the commit rolls back both, so Zahlo's retry does the work again. transaction(() => { const fresh = db .prepare("INSERT INTO processed_events (event_id) VALUES (?) ON CONFLICT DO NOTHING") .run(event.id); if (fresh.changes === 1) apply(); }); return send(response, 200, "ok"); } return send(response, 404, "Not found"); } createServer((request, response) => { handle(request, response).catch((error) => { console.error("request failed", error); if (!response.headersSent) send(response, 500, "Internal error"); }); }).listen(port, () => console.log(`Listening on ${siteUrl}`)); ``` The embedded page loads `/sdk/v1/zahlo.js` and mounts the form. Its callbacks only change what the customer sees. ```html public/subscribe.html