Checkout capability boundary
Public checkout uses an opaque bearer capability.
Use the returned checkoutUrl unchanged. Its fragment carries an opaque bearer capability; keep the full URL out of logs, analytics and referrers. Never use a merchant secret in the browser. The hosted checkout extracts that capability and sends it as X-Checkout-Token.
| Method | Path | Purpose |
|---|---|---|
| GET | /v2/checkout/:id | Read public session and retained attempts |
| POST | /v2/checkout/:id/attempts | Select an offered route with { "asset": "USDT", "network": "TRON" } |
Route enums include USDT/USDC and TRON/ETHEREUM/BSC/POLYGON; the enum is not availability. New hosted attempts currently accept USDT only. Use only returned routes; never construct availability from a registry. Repeating selection retains original instructions and the fixed session deadline. Public reads omit checkoutUrl and restrict the buyer pricing view.
This capability only grants access to the checkout session. It is neither a project API key nor payment proof. Server fulfillment requires the project secret-key session read, signed paid event, saved binding and deduplication.