FAQ

Do I need to handle PCI compliance?

No. Card details never touch your server. The customer enters their card on our hosted checkout page. You stay out of PCI scope.

What currencies do you support?

All 158 ISO 4217 currencies plus XCG (Caribbean Guilder). Your account manager will configure which currencies are enabled for your merchant account.

What payment methods are available?

Credit and debit cards, plus local payment methods. Your enabled methods depend on your merchant configuration.

How do amounts work?

Amounts are in the smallest currency unit. For USD, EUR, GBP — that's cents.

How long do checkout sessions last?

Default: 30 minutes. You can set expires_in from 5 minutes to 24 hours.

What happens if a session expires?

The checkout_session.expired event fires. The customer sees an expiry message. You can create a new session for them to try again.

Can I test without real money?

Yes. Use your test API keys (toggle the Test/Live switch above). Test mode processes everything through the sandbox — no real charges.

What does Idempotency-Key do?

If your request fails mid-flight (network timeout, etc.), you can safely retry with the same Idempotency-Key. We'll return the original response instead of creating a duplicate session.

Use a UUID. One per checkout session creation.

My webhook didn't arrive. Now what?

1. Wait 5 minutes — retries are in progress
2. If still nothing, poll GET /payment-intents/{pi_id} to check the status
3. Check that your webhook endpoint returns 200 and responds within 10 seconds

See Webhooks for details.

What does client_secret do?

It's for embedded/SDK integrations. If you're using hosted checkout (redirecting to our URL), you can ignore it.

Can I update a session after creating it?

Yes, as long as it's still open. You can update the amount, metadata, return/cancel URLs, and expiry. The underlying Payment Intent amount is synced automatically.

What if the customer's card requires 3DS?

We handle it. The customer sees the 3DS challenge on our hosted page. You don't need to do anything — the Payment Intent moves through requires_action → processing → succeeded automatically.