Skip to main content
Checkout uses the same cart capability, revision, and idempotency protections as other cart mutations. Creating a payment intent is a write and is never an anonymous lookup by cart ID.

1. Finalize the cart

Each call uses the latest cart revision. If a call returns CART_CONFLICT, refresh the cart and require an explicit retry.

2. Create the payment session

Branch on payment.provider. Pass a Stripe clientSecret to Stripe Elements, or initialize Square Web Payments with its application and location IDs. Raw card data and provider secrets never pass through storefront code.

3. Confirm payment

Do not add the cart ID or capability to return_url. Keep the cart session in tab-scoped storage so the returning page can continue securely.

4. Poll the order result

Only completed is success. Never infer success from a redirect or from the absence of an error.

Accept Payments

Integrate Stripe Elements without exposing server secrets.

Order Tracking

Implement bounded result polling and receipts.