Website Checkout

Hosted checkout + customer portal for web apps. Server creates checkout session; browser redirects to SolvaPay; return URL refreshes access from server truth.

Guardrails

• Never build custom card forms when hosted checkout is acceptable.
• Never expose SOLVAPAY_SECRET_KEY in client code.
• Always keep checkout session creation on the server.
• Always verify access state from server truth after returning from checkout.
• Always use SolvaPay naming in user-facing text.

Gotchas