Sessions & security

API keys

// ✅ Correct
const client = Wajub('pk_test_abc123');

// ❌ Rejected by the SDK
Wajub('sk_test_abc123');
// WajubError: Secret key cannot be used in the browser

Recommended flow (production)

1. Your backend creates a payment with sk_… (via @wajub/node or POST /payments) and returns authorization_token.
2. Your frontend passes that token as sessionId and mounts checkout.

// Frontend — after your API route returns the token
const { sessionToken } = await fetch('/api/checkout/session', { method: 'POST' })
.then(r => r.json());

const rt = await loadWajub();
rt?.wajub.mount('#checkout', { sessionId: sessionToken });

Create a session

Use @wajub/node or the REST API with your secret key. Optional theming sets logo and primary color at creation — see Branding & theming.

curl https://api.wajub.com/payments \
-H "Authorization: sk_test.xxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
  "amount": 35000,
  "currency": "XOF",
  "reference": "ORDER-123",
  "description": "Order #123",
  "customer": {
    "email": "buyer@example.com",
    "name": "Amina N.",
    "phone": "+2250700000000"
  },
  "callback": "https://shop.example.com/order/complete",
  "metadata": { "order_id": "123" }
}'

{
"authorization_token": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"authorization_url": "https://pay.wajub.com/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"transaction": { "id": "trx_01JXXXXXXXXXXXXX", "status": "pending" }
}

Pass authorization_token to Wajub Components as sessionId.

Client-side create (prototypes only)

For demos you may call createPayment() with a publishable key in the browser. In production, keep session creation on your server.

const client = Wajub('pk_test_...');
const { sessionId } = await client.createPayment({
amount: 35000,
currency: 'XOF',
reference: 'ORDER-123',
customer: { email: 'buyer@example.com' },
callback: 'https://shop.example.com/complete',
});
client.mount('#checkout');

Callback URL

When creating a session, pass an HTTPS base URL (no status query param). Wajub redirects the customer after payment with:

Example redirect:

https://shop.example.com/order/complete?status=complete&reference=trx_01JXXX&trxref=ORDER-123

Session token lifecycle

• Valid while the payment is not terminal;
• Expires after a short grace period once succeeded, failed, expired, or cancelled;
• Re-use the same token for embed remounts until the session ends.

Security checklist

For multi-domain shops, pass embedOrigin:

wajub.mount('#checkout', {
sessionId,
embedOrigin: 'https://shop.example.com',
});