Apply Security & Best practices

Secure integration requires server-side payment verification, proper handling of hosted card fields, protection against duplicate submissions, and correct SDK lifecycle management. Additional practices cover versioning, SRI, retry behaviour, and troubleshooting.

Security & Best practices

1. Never trust the complete event

Never fulfil obligations based on the complete event. It happens in the customer's browser and can be forged.

Deliver goods or services only after a server-side check:

• the platform Webhook;
• the Payment Request status query by paymentRequestId via the private API.

2. Card data never touches your page

The fields live in iFrames on the platform domain, and your JavaScript has no access to their values — only to validity events.

Do not try to collect PAN/CVV with your own fields.

3. Keep the field containers in the DOM

Hide the form with display: none; removing the containers unmounts the iFrame fields.

4. Block duplicate submits

Disable the button and the fields while processing:

hpf.setDisabled(true)

5. Treat auto_retry as an indication only

auto_retry indicates that the retry is already running on the server. Calling retry() at that moment would create a parallel attempt.

6. Clean up in SPAs

Call checkout.destroy() when the Checkout page unmounts. Create a new instance for a new payment.

7. Version pinning + SRI (CDN)

For strict audit requirements, use the exact version pin:

• /cdn/v1.0.4/... and the integrity hash from manifest.json.

Otherwise, use the floating major channel:

• /cdn/v1/... to receive fixes automatically.

8. Logs

All SDK service messages in the console carry the [CheckoutSDK] prefix, which is useful for filtering when contacting support.