Payment Flow
How checkout payment flow works end-to-end.
Updated
On this page
Payment Lifecycle
Customer enters card details (client-side)
↓
dash.payment.tokenize() → secure token
↓
dash.checkout.complete() sends token to server
↓
Server charges via payment processor (Stripe/Authorize.net)
↓
Success → Order created, confirmation shown
Failure → Error returned, customer can retry
Key Security Points
- Raw card numbers never touch your server
- Tokenization happens client-side via the processor's secure SDK
- Tokens are single-use and expire quickly
- PCI DSS compliance is handled by the payment processor
Retry Failed Payments
// If payment fails but order was created
const result = await fetch("/storefront/checkout/repayment", {
method: "POST",
headers: { "Content-Type": "application/json", "X-API-Key": apiKey },
body: JSON.stringify({
order_id: "ord_abc123",
payment_token: { token: newToken, descriptor },
}),
})
Next Steps
- Saved Cards — Card on file
- Payment Webhooks — Payment event notifications
- API Key Security — Securing payment flows