Redirect Security
Keep checkout navigation separate from payment authorization.
Allow only exact domains you control and use HTTPS in production. Do not use wildcard domains, accept user-supplied return URLs, or place secrets in query parameters.
Success and cancel URLs execute in an untrusted browser. A customer can open, replay, or modify navigation. Use sessionId only to find the saved v2 order binding. Require verified payment_session.paid and authenticated GET /v2/payment-sessions/:id, matching project, mode, currency and pricing before fulfillment. Existing v1 integrations use their saved invoiceId, invoice.paid and authenticated v1 read. See return URLs and order confirmation.