Embedded checkout

Two lines of HTML mount the APXRAILS checkout as an overlay on your own page. Card entry stays inside our sandboxed iframe, so your PCI scope stays SAQ A.

1. Register your origin

In Settings → Allowed origins (or Developers → Embed), add the exact origin of the page that will embed the checkout, e.g. https://store.example. The embed is fail-closed: an unregistered origin renders nothing — no wildcard exists.

2. Create a session server-side

Same call as the quickstart. Pass the session's id and token to your page — the url field contains both: …/c/<id>?t=<token>.

3. Drop in the two lines

html

<script async defer src="https://pay.apxrails.com/embed/v1/loader.js"></script>
<div data-apx-checkout-session-id="<id>-<token>"></div>

The loader mounts a sandboxed iframe (no allow-top-navigation), binds itself to your page's origin on first contact, and resizes to content. Listen for completion:

document.addEventListener('apx-checkout:complete', (event) => {
  // Re-query the session server-side before fulfilling.
});
// Also emitted: apx-checkout:ready / :cancel / :error

PCI posture

The hosted redirect keeps you in SAQ A with no script-protection criterion; the embed keeps card entry inside APXRAILS-controlled, provider-hosted surfaces. Pin the loader with Subresource Integrity if your policy requires it — hashes, CSP guidance, and the attestation letter live in the merchant PCI pack (dashboard → Developers → Embed → PCI pack).

Embedding a payment link

A payment link can mount as the same overlay with no server-side session at all — swap the attribute for data-apx-checkout-link-id:

html

<script async defer src="https://pay.apxrails.com/embed/v1/loader.js"></script>
<div data-apx-checkout-link-id="plink_01J…"></div>

Each open mints a fresh checkout session inside the iframe (the payment-link pattern) and binds it to your page's origin before rendering. The same origin registration and apx-checkout:* events apply.

Notes

Provider-hosted redirect methods (3DS challenges) open in a new tab; the overlay polls state and resumes when the buyer returns.