Crea un token de SDK de corta duración
Intercambia tu clave de API privada por un client token de corta duración para inicializar el SDK JS de Therius en el navegador de forma segura.
POST /sdk/session intercambia tu clave de API privada de comercio por un clientToken JWT de corta duración con un TTL de 30 minutos. Pasa el clientToken al navegador para inicializar new TheriusSDK({ clientToken }). Tu clave privada nunca llega al navegador — se queda en tu servidor, donde pertenece.
El cuerpo de la solicitud es completamente opcional — llámalo sin cuerpo para obtener un clientToken simple. Establece country (requerido en cuanto también estableces amount, currency u orderCode) para vincular la sesión y recibir un sessionId. Ver los paneles de parámetros y respuesta de arriba para la lista completa de campos.
clientToken incrusta un hash HMAC-SHA256 de tu clave pública. Tu clave privada sin procesar nunca está presente en la carga del token y nunca llega al navegador.clientToken del lado del cliente.
Autorizaciones
Your secret API key: Bearer prv_production_xxx (production) or Bearer prv_sandbox_xxx (sandbox).
Cuerpo
ISO 3166-1 alpha-2 code of the shopper country. Optional for a bare clientToken; required if you also set amount, currency, or orderCode (those create a bound checkout session).
Locked amount in minor units. Omit to let the browser SDK manage the amount.
Locked ISO 4217 currency. Omit to let the browser SDK manage it.
Number of installments to offer. Defaults to 1.
Your order reference to attach to the resulting payment.
Your shopper identifier - enables saved-card retrieval and the save-card checkbox for this session.
Pre-assigned Therius payment code, if you allocate them yourself.
UUID of a Checkout Builder configuration to bind to this session.
Declares this session's checkout starts a stored-credential mandate (e.g. {"type": "recurring"} for a merchant-managed subscription you bill against yourself later). Requires customerId. When set, the Checkout Widget shows a fixed "card will be saved" disclosure instead of the optional save-card checkbox, and the server forces tokenization + this stored-credential tagging on the resulting charge regardless of what the browser sends. Omit for a plain checkout that just follows the Checkout Builder's save-card setting.
The payer's billing address, if you already know it. The Checkout Widget does not ask the shopper for fields you supply here, and a purchase that carries no address of its own is filled in from it. Boleto requires an address to register the voucher.
Shipping address, same shape as billingAddress. Filled into a purchase that carries none of its own. Requires country.
The payer's data, when you already know it. The Checkout Widget prefills (or, when the merchant chose 'Required, hidden if in session', skips) the matching fields and a purchase fills what it left blank from it. Defaults, not locks. Requires country.
Locks the order's line items for this session. A purchase made with the session token uses these and ignores any lineItems in the purchase call.
Locks the Level 2/3 card data for this session. A purchase made with the session token always uses it and ignores any commercialData in the purchase call, because that call can come from the browser. Requires country.
Respuesta
SDK session token
Short-lived JWT for the browser SDK. Pass as Bearer to the SDK endpoints.
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Token lifetime in seconds.
1800
The merchant default Checkout Builder config, when no checkoutConfigId was supplied.
Checkout session ID - present when country created a session.
Echoed session country.
Echoed locked amount.
Echoed locked currency.
Echoed stored-credential intent, present only when the request set cardOnFile.
SRI hash of the latest SDK bundle served at GET /sdk/js, when available. Prefer the immutable release in sdk.
The current immutable SDK release. Render url and integrity into the page script tag (with crossorigin="anonymous") on every page render; the URL always serves exactly the bytes the hash describes. Absent when no release is available, in which case use GET /sdk/js without integrity.