Return URLs
Configure exact, safe browser destinations after checkout.
Production return URLs must use HTTPS and match an explicitly allowed domain. Wildcards are not supported; list each subdomain separately. The configured URL must not contain user information or a fragment. Local development may use HTTP and explicit ports.
After a paid checkout BramaPay appends invoiceId to the success URL. The cancel URL is used for customer navigation away from a payable checkout.
Redirects are untrusted browser input
Never grant goods, credits, or access because a browser reached the success URL. Verify PAID with a signed webhook and/or the authenticated invoice API.
Changes apply to new payment flows; always use the URLs returned or associated with the invoice you created.