Checkout Sessions API
Create an order-linked checkout URL with a trusted amount, reference, expiry, metadata, and idempotency key.
APIs and SDKs for checkout
Create checkout sessions from a trusted backend, redirect customers to a Payclave-hosted payment page, and connect independently verified invoice status to fulfillment through signed webhooks.
Create an order-linked checkout URL with a trusted amount, reference, expiry, metadata, and idempotency key.
Prefer secret-key creation from the merchant backend, with limited publishable-key flows available for simple integrations.
Authenticate payment events with HMAC SHA-256 signatures before updating fulfillment state.
From order to payment record
The merchant backend calls the checkout-session endpoint with the final order amount and a unique idempotency key.
The frontend opens the returned Payclave checkout URL; secret credentials never enter the browser bundle.
Payclave verifies settlement and sends a signed invoice event to the merchant's configured webhook endpoint.
The merchant verifies the signature, deduplicates the event, and changes only the matching order state.
The recommended production integration creates checkout sessions from the merchant server with an sk_live_ or sk_test_ key. That keeps product price, discounts, inventory, and order ownership behind the merchant's authentication boundary.
An idempotency key lets a retried order request return the intended checkout operation without creating unrelated payment sessions. Publishable keys are intentionally limited and should not become a way for a browser to set trusted prices for high-value orders.
The API returns a Payclave checkout URL that the merchant can open from its normal payment button. Payclave handles the customer-facing wallet connection or scan/copy instructions and shows the checkout's current payment status.
This keeps wallet and route UI out of the merchant application while preserving the merchant's own order page, pricing logic, and post-payment experience.
Payclave signs webhook payloads with HMAC SHA-256 and sends the signature in the X-Payclave-Signature header. The merchant must verify the raw payload before trusting the event and should return a successful response only after durable processing.
Delivery attempts, response codes, retry state, and replay controls give the merchant an operational trail. The invoice API remains available when the backend needs to reconcile a delayed or missed event.
Frequently asked questions
The preferred production model creates them from the merchant backend with a secret key. Limited publishable-key creation can support simple browser integrations, but it should not let the customer control a trusted order amount.
Webhook payloads use an HMAC SHA-256 signature delivered in the X-Payclave-Signature header. Verify the signature with the endpoint secret before processing the event.
Webhook delivery is database-backed and supports retry scheduling, response logging, and manual replay so a temporary endpoint failure does not erase the payment event.
No. Test and live modes are separated, with distinct key prefixes and records. Build and validate the complete integration in test mode before requesting live activation.
Explore Payclave
Accept stablecoin payments with Payclave hosted checkout sessions, direct wallet settlement, independent onchain verification, and signed webhooks.
Learn moreUse a non-custodial crypto checkout where stablecoin settlement goes to the merchant's configured wallet and payment status is verified independently.
Learn morePayclave pricing: test mode is free, with a flat 0.7% fee per live stablecoin payment and no monthly or setup fee.
Learn moreTest the flow
Use test keys, the API playground, and signed webhook examples to validate the complete order-to-payment flow.