Payment confirmation & errors
For the supported LIVE session interface use:
GET /public/catalog/stores/:storeId/payment-confirmations
- Authenticate server-side with the store’s matching key.
- Supply at least one supported lookup:
sessionId,orderReforidempotencyKey. - Read the returned payment state. Fulfill only after a confirmed successful payment; a success redirect, created session or pending state is insufficient.
- Reconcile uncertain results using the existing reference. Avoid creating a second charge just because a request timed out.
Kordiva handles Stripe notifications for its payment flows. A merchant does not need to register a separate Stripe webhook just to confirm a Kordiva checkout. SDK 0.1.3 adds a separate Business Merchant webhook channel; endpoint setup is in CMS, not an SDK management API.
For a custom storefront: The frontend checks a protected status route on your backend, which verifies shopper/cart ownership and calls LIVE payments.confirm() using a server-side Store API key. Kordiva owns the Stripe webhook. 0.1.3 Business events use the separate HMAC merchant verifier; the LIVE confirmation flow below remains supported. See the tested SDK payment status guide for a ready Node route and bounded polling. TEST uses its isolated TEST receipt/dashboard instead.
| Error / condition | Action |
|---|---|
VALIDATION_INVALID_PARAMS | Check required references, product/variant UUIDs and request shape |
TEST_API_KEY_REQUIRED | Use a matching TEST key for the TEST-only checkout endpoint |
TEST_SALE_MARKET_REQUIRED | Supply the required Individual TEST sale context |
TEST_API_ENDPOINT_UNSUPPORTED | Use supported TEST reads or the dedicated TEST checkout interface; do not call LIVE-only confirmation with a TEST key |
| Authentication/store/plan restriction | Verify key scope, revocation, role and plan without exposing the key |
| Individual digital/market/tax restriction | Resolve approved product and market configuration through Kordiva; never bypass it with another country |
Keep internal order/session references in protected integration storage. Strip provider IDs, tokens and buyer details from support screenshots.