Skip to main content

Before You Begin

You need 3 things from your Ozura Dashboard:

Keeping Customers on Your Site (Popup)

To open checkout in a popup instead of redirecting, no registration or approval is needed. Pass embedMode: "popup" and parentOrigin (the exact origin of your page) in your session create request. Checkout sends the result back to that origin.
Iframe embedding is coming soon. See Integration Modes for the full popup and new tab implementation.
Don’t have your Vault API Key? Find it under Developers → Vault Key.Environment Variables 101: Never hardcode API keys in your code. Instead:
  • Create a .env file: VAULT_API_KEY=your_actual_key
  • Access it: process.env.VAULT_API_KEY (Node.js) or os.environ['VAULT_API_KEY'] (Python)
  • Never commit .env to git! Add it to .gitignore

Step 1: Create a Checkout Session

From your server (not browser), make this API call:
What’s “your server”? This is backend code — a Node.js app, PHP script, Python app, etc. If you only have static HTML, you cannot call this API directly (API keys would be exposed). Consider using Payment Links instead.
Replace:
  • YOUR_VAULT_API_KEY → Your Vault API Key (Developers → Vault Key)
  • YOUR_MERCHANT_API_KEY → Your Merchant API Key (Developers → API Keys)
  • YOUR_MERCHANT_ID → Your Merchant ID (Developers → Identity)
  • URLs → Your actual website URLs
You’ll get back:

Step 2: Redirect Your Customer

Send the customer’s browser to the checkoutUrl:
The customer will see a secure payment form with your store name and the amount.
For local development, your URLs can use http://localhost. In production, always use HTTPS.

Step 3: Customer Pays

The customer:
  1. Enters their card details
  2. Clicks “Pay Now”
  3. Gets redirected back to your site

Step 4: Handle the Result

After payment, the customer lands on one of your URLs: Success URL includes payment details:
Important: Ozura automatically marks the session as “completed” before redirecting. However, you should still verify the session server-side (call GET /api/sessions/{sessionId}) before fulfilling orders to prevent URL spoofing. See Security for details.

That’s It!

You’re now accepting payments. What’s next?