## How it works

A checkout session is the customer-side flow for an existing payment. Your server creates the payment; the browser receives only its hosted link or scoped client secret.

## Implementation

Retrieve payment state from the server and use the checkout URL for hosted or iframe integration. Keep the secret API key out of the customer-facing page. Restrict iframe origins and validate postMessage origin and source. For custom redirect methods, handle the provider next action and reconcile the result through signed webhooks.

## In this area

- Methods

## Related guides

- [Embedded & own checkout](/docs/payment-api/embedded-checkout/)