Embed checkout with @vexpay/js

Mount VEXPay hosted checkout in an iframe so card and OTP data never touch your page.

Create a session on your server

Call POST /v1/checkout/sessions (or vexpay.checkout.sessions.create) with amountUsd and allowedOrigins for the pages that will embed the checkout. Return only clientSecret to the browser — never your API key.

Mount in the browser

JavaScriptjavascript

import { checkout } from '@vexpay/js';

const cx = checkout({ clientSecret });
cx.on('ready', () => console.log('checkout ready'));
cx.on('completed', ({ sessionId, paymentId }) => {
  // Advisory — confirm on your server before fulfilling
});
cx.on('error', ({ code }) => console.error(code));
cx.mount('#pay');

// Pages that cannot iframe: redirectToCheckout({ clientSecret })