← Home
—/hyax-api/v1/checkout-sessions

Hosted checkout sessions

Sell to a user of *your* app and know exactly who paid. Your server creates a session naming the buyer (email + your own user id) and gets back a one-time URL on your Hyax store (`/pay/cs_…`). The buyer's email is locked on that page, every payment method (card, USDC) re-checks the session server-side before charging, and the resulting `order.created` webhook carries your `externalUserId`, the `checkoutSessionId` and any `metadata` you passed — so you never have to match on email or trust a `?email=` query param. Sessions expire (default 24h) and can only be paid once.

Base URL: https://platform.hyax.com · Replace YOUR_API_KEY with your team API key.

Request

# This route is session-based, multipart, or provider-specific.
# Inspect: apps/web/server/routes/hyax-api/

Response

Flow

  1. Your server        POST /hyax-api/v1/checkout-sessions   { email, externalUserId, productId, successUrl }
  2. Your app           redirect the user to data.url
  3. Buyer              pays by card or USDC; the email can't be changed
  4. Hyax → your server order.created webhook with externalUserId + checkoutSessionId
  5. Buyer              sent to successUrl

Why not /buy/{slug}?email=…&uid=…?

  That link still works for casual sharing, but anything in the query string
  can be edited by the visitor. A session is created server-to-server, is
  bound to one email, and is verified again at payment time — on the
  crypto path that also means the exact identifier amount can only ever
  be minted for the account you named.