Checkout Quickstart

Slash Payment Processing is in beta and not enabled for all accounts. Contact support@joinslash.com to get access.

1. Create a session

Call POST /checkout-session with your API key. amount is in cents; currency supports usd. The X-Idempotency-Key header is required — retrying with the same key returns the existing session instead of creating a duplicate.

curl https://api.slash.com/checkout-session \
  -X POST \
  -H "X-API-Key: $SLASH_API_KEY" \
  -H "X-Idempotency-Key: order_1234" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 5000, "currency": "usd", "customMetadata": { "orderId": "ord_1234" } }'

const res = await fetch("https://api.slash.com/checkout-session", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.SLASH_API_KEY,
    "X-Idempotency-Key": "order_1234",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: 5000,
    currency: "usd",
    customMetadata: { orderId: "ord_1234" },
    // Optional: card stays enabled; wallet fields default to true.
    config: { paymentMethods: { applePay: true, googlePay: true } },
  }),
});
const { checkoutSession } = await res.json();

The response includes a hosted url:

{
  "checkoutSession": {
    "id": "acq_checkout_...",
    "url": "https://app.slash.com/checkout/acq_checkout_...",
    "status": "open",
    "amount": 5000,
    "currency": "usd"
  }
}

2. Embed it

Install the SDK and mount the url. Point fetchUrl at your own backend endpoint that creates the session, so your API key stays server-side.

npm install @slashfi/checkout-js

import { loadSlashCheckout } from "@slashfi/checkout-js";

const slashCheckout = await loadSlashCheckout();

const checkout = await slashCheckout.createEmbeddedCheckoutPage({
  fetchUrl: () =>
    fetch("/create-checkout-session", { method: "POST" })
      .then((r) => r.json())
      .then((s) => s.url),
  onComplete: () => showConfirmation(),
});

checkout.mount("#checkout");

3. Fulfill on the webhook

Fulfill the order when checkout_session.completed arrives. Your customMetadata is echoed back on the event body:

{
  "event": "checkout_session.completed",
  "eventId": "public_webhook_notification_...",
  "entityId": "acq_checkout_...",
  "eventTimestamp": "2026-07-22T06:00:00.000Z",
  "customMetadata": { "orderId": "ord_1234" }
}

Anyone who discovers your webhook URL can POST to it, so verify the slash-webhook-signature header before fulfilling. Every delivery is signed over the raw request body with Slash’s public RSA key — see webhook signing for details:

import crypto from "node:crypto";

// From /api-reference/public-rsa-key
const SLASH_WEBHOOK_PUBLIC_KEY = process.env.SLASH_WEBHOOK_PUBLIC_KEY;

// The signature covers the raw bytes, so read the body unparsed.
app.post("/webhooks/slash", express.text({ type: "*/*" }), (req, res) => {
  const signature = req.headers["slash-webhook-signature"];
  const isAuthentic =
    typeof signature === "string" &&
    crypto.verify(
      "sha256",
      Buffer.from(req.body),
      SLASH_WEBHOOK_PUBLIC_KEY,
      Buffer.from(signature, "base64")
    );
  if (!isAuthentic) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  if (event.event === "checkout_session.completed") {
    fulfillOrder(event.customMetadata.orderId);
  }
  res.sendStatus(200);
});

Deliveries that aren’t acknowledged with a 2xx are retried a limited number of times before the notification is marked failed, so make fulfillment idempotent — dedupe on eventId (or your own customMetadata key) — and don’t rely on webhooks alone: GET /checkout-session/{id} returning status: "complete" is equivalent to the webhook and catches any missed deliveries. Full SDK options are in the checkout-js reference.

Payment Processing

Checkout Session

Payment Intent

Checkout Quickstart

1. Create a session

2. Embed it

3. Fulfill on the webhook

​1. Create a session

​2. Embed it

​3. Fulfill on the webhook

1. Create a session

2. Embed it

3. Fulfill on the webhook