OxaPay Custom Checkout

Overview

OxaPay Custom Checkout is a merchant-controlled checkout experience that uses OxaPay payment APIs or white-label payment data rather than relying only on a standard hosted page. The merchant can present branded asset and network selection, payment instructions, status, and order context while OxaPay processes the payment workflow. Custom presentation does not make browser state authoritative; server-side API data and verified callbacks remain the payment source of truth.

Important risks include client-side amount tampering, stale addresses, incorrect QR or URI data, callback forgery, duplicate sessions, and frontend status drift.

Merchants should store OxaPay track and order IDs, request and response, quote, address, expiry, callback validation, transaction, status, and settlement.

Implementations should link OxaPay Custom Checkout to Custom Checkout and Pay by OxaPay through auditable references. Although the records can share a customer or transaction, OxaPay Custom Checkout retains its own authority, lifecycle, and recovery rules.

Operational procedures for OxaPay Custom Checkout should cover duplicate requests, unavailable services, delayed status updates, mismatched currencies or networks, staff intervention, and customer disputes. When OxaPay Custom Checkout interacts with Custom Checkout, current capabilities and parameters should be checked against the relevant OxaPay documentation because supported options and service configuration can change.

Use of OxaPay Custom Checkout should preserve the relevant OxaPay service context, tracking or request identifier, merchant-side order or account reference, effective configuration, timestamps, fees, and resulting balance or transaction evidence. When OxaPay Custom Checkout interacts with Custom Checkout, the merchant should process OxaPay callbacks or API responses idempotently and reconcile them with its own commercial and accounting records.

Credentials for OxaPay Custom Checkout should be limited to the required OxaPay service and stored only on trusted servers or approved secret-management systems. When OxaPay Custom Checkout interacts with Custom Checkout, API keys, wallet secrets, and privileged bot or account sessions must not appear in browser code, public repositories, customer chats, screenshots, or ordinary application logs.