> ## Documentation Index > Fetch the complete documentation index at: https://docs.slash.com/llms.txt > Use this file to discover all available pages before exploring further. # Create checkout session > Create a checkout session for collecting a card payment through the Slash hosted checkout. Returns a hosted checkout `url` to embed in your page. Requires an `X-Idempotency-Key` header; retries with the same key return the existing session. Slash Payment Processing is in beta and not enabled for all accounts. Contact [support@joinslash.com](mailto:support@joinslash.com) to get access. ## OpenAPI ````yaml post /checkout-session openapi: 3.1.0 info: title: Slash Public API description: API description version: 0.0.1 contact: {} servers: - url: https://api.slash.com description: production security: - api_key: [] - partner_api_key: [] - bearer: [] - developer_application: [] paths: /checkout-session: post: description: >- Create a checkout session for collecting a card payment through the Slash hosted checkout. Returns a hosted checkout `url` to embed in your page. Requires an `X-Idempotency-Key` header; retries with the same key return the existing session. parameters: - name: X-Idempotency-Key description: >- A unique key for this checkout session. Retrying a request with the same key returns the previously created session instead of creating a new one. in: header required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: amount: type: integer minimum: 1 description: Payment amount in cents. Must be strictly positive. currency: type: string description: >- ISO currency code for the payment. Only `usd` is currently supported. enum: - usd customMetadata: type: object description: >- Custom metadata to associate with the checkout session. Echoed on webhook events for this session. additionalProperties: true config: type: object description: >- Configuration for the hosted checkout page. Echoed on reads and editable while the session is open. properties: prefillEmail: type: string format: email description: Email address to prefill the hosted checkout with. prefillName: type: string description: Buyer name to prefill the hosted checkout with. hideEmail: type: boolean description: Hides the email field in the hosted checkout entirely. disableEmail: type: boolean description: >- Renders the email field read-only. Pairs with prefillEmail to show a fixed address the buyer cannot edit. prefillAddress: type: object description: Billing address to prefill the hosted checkout with. properties: name: type: string description: Name on the billing address. country: type: string description: Country for the billing address. line1: type: string description: First billing address line. line2: type: string description: Second billing address line. city: type: string description: City for the billing address. state: type: string description: State or region for the billing address. postalCode: type: string description: Postal code for the billing address. paymentMethods: type: object description: >- Wallet payment methods to enable in the hosted checkout. Card is always enabled. Omitted fields default to enabled. properties: applePay: type: boolean description: Whether Apple Pay is enabled. Defaults to true. googlePay: type: boolean description: Whether Google Pay is enabled. Defaults to true. expiresAt: type: string format: date-time description: >- ISO-8601 timestamp after which the session can no longer be paid. Defaults to 24 hours after creation. Must be at least 30 minutes and at most 7 days in the future. required: - amount - currency responses: '200': description: OK content: application/json: schema: type: object properties: checkoutSession: $ref: '#/components/schemas/CheckoutSession' x-entrypoint: virtualPath: schemas/CheckoutSession sourcePath: schemas/CheckoutSession.yaml title: CheckoutSession origin: ./src/publicApi required: - checkoutSession '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: TooManyRequests content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal Error content: application/json: schema: $ref: '#/components/schemas/Error' security: - api_key: [] - bearer: [] components: schemas: CheckoutSession: type: object description: >- A checkout session represents a single hosted payment attempt. Embed the session's `url` in your page (via the Slash checkout SDK or an iframe) to collect a card payment. properties: id: type: string description: Unique identifier for the checkout session. url: type: string description: >- Hosted checkout URL to embed. Treat it as single-use and mint one session per buyer checkout. status: type: string description: >- Status of the checkout session. `open` sessions are payable; `complete` sessions have a confirmed settled payment; `expired` sessions can no longer be paid. enum: - open - complete - expired amount: type: integer description: Payment amount in cents. currency: type: string description: >- ISO currency code for the payment. Only `usd` is currently supported. enum: - usd customMetadata: type: object description: >- Custom metadata associated with the checkout session. Echoed on webhook events for this session. additionalProperties: true config: type: object description: >- Configuration for the hosted checkout page, editable while the session is open. properties: prefillEmail: type: string description: >- Email address the hosted checkout is prefilled with, if provided at creation. prefillName: type: string description: >- Buyer name the hosted checkout is prefilled with, if provided at creation. hideEmail: type: boolean description: Hides the email field in the hosted checkout entirely. disableEmail: type: boolean description: >- Renders the email field read-only. Pairs with prefillEmail to show a fixed address the buyer cannot edit. prefillAddress: type: object description: >- Billing address the hosted checkout is prefilled with, if provided at creation. properties: name: type: string description: Name on the billing address. country: type: string description: Country for the billing address. line1: type: string description: First billing address line. line2: type: string description: Second billing address line. city: type: string description: City for the billing address. state: type: string description: State or region for the billing address. postalCode: type: string description: Postal code for the billing address. paymentMethods: type: object description: >- Wallet payment methods enabled for the hosted checkout. Card is always enabled. properties: applePay: type: boolean description: Whether Apple Pay is enabled. googlePay: type: boolean description: Whether Google Pay is enabled. expiresAt: type: string format: date-time description: ISO-8601 timestamp after which the session can no longer be paid. createdAt: type: string format: date-time description: ISO-8601 timestamp the session was created at. required: - id - url - status - amount - currency - expiresAt - createdAt x-entrypoint: virtualPath: schemas/CheckoutSession sourcePath: schemas/CheckoutSession.yaml title: CheckoutSession origin: ./src/publicApi title: CheckoutSession Error: type: object properties: message: type: string name: type: string identifier: type: string rawStatus: type: number meta: type: object additionalProperties: true required: - message - name - identifier - rawStatus x-entrypoint: origin: ./src/publicApi sourcePath: ./src/publicApi/main.yaml title: Error virtualPath: components/Error title: Error securitySchemes: api_key: type: apiKey description: | API key authentication for public API requests. Keys come in two flavors: - *Legal-entity-scoped keys* are pinned to a single legal entity. Minted via the dashboard under a specific entity; every request acts on that entity. - *User-scoped keys* are pinned to a user and span every legal entity that user has access to. Every request made with a user-scoped key (except `GET /legal-entity`, which lists the legal entities the user can access) must include an `x-legal-entity` header naming the legal entity the request is operating on. Requests without the header are rejected with `400`. The authenticated user must have an active permission role on the supplied legal entity, otherwise the request is rejected with `403`. name: X-API-Key in: header partner_api_key: type: apiKey description: | Partner-program API key authentication. Keys are minted in the partner dashboard (Developers → API Keys), are scoped to a single partner program, and are prefixed with `sk_partner_`. Partner keys are only accepted by routes that declare this scheme; they are rejected by `api_key` routes and vice versa. name: X-API-Key in: header bearer: type: http scheme: bearer developer_application: type: http scheme: basic ````