@kordiva/checkout — safe browser handoff

Published release: SDK 0.1.3 is publicly available on npm. Package installation does not activate new backend features.

@kordiva/checkout

Public npm package · Checkout guide

Use this small, credential-free ESM helper to validate a Kordiva checkout URL and navigate to it. It does not create a checkout session, charge a card, confirm payment or hold an API key.

pnpm add @kordiva/[email protected]

Validate the URL first

import { checkoutHref, redirectToCheckout } from "@kordiva/checkout";

// The URL comes from your protected server or an existing approved Checkout Link.
// Configure the exact origin independently. Never derive it from user input.
const allowedOrigins = ["https://store.kordiva.com"];
const safeUrl = checkoutHref({ url: checkoutUrlFromBackend }, allowedOrigins);

// In the browser, after a real user action:
redirectToCheckout({ url: checkoutUrlFromBackend }, allowedOrigins);

checkoutHref returns a validated string or throws for an unsafe/unknown origin. redirectToCheckout validates before navigation; optionally pass a custom navigate callback as the third argument.

Local TEST only: explicitly pass { environment: "TEST", allowLocalTest: true } as the third argument to checkoutHref or fourth to redirectToCheckout, and allowlist the exact loopback origin. This permits only the recognized local /api/test-commerce/link?token=... route. It never permits remote HTTP or LIVE /q/ over HTTP.

Do not pass Store API secrets to the browser. Treat redirects as navigation, not evidence that money was received. For verified LIVE payment status use the server-only @kordiva/sdk guide and payment confirmation. For React, use @kordiva/react.

Business integration

Recurring checkout and subscription reads → Signed Business events → Raw-body verification → Business refunds → API reference. Individual MoR follows its separate refund process.