Crie um token de SDK de curta duração
Troque a sua chave de API privada por um client token de curta duração para inicializar o SDK JS do Therius no navegador com segurança.
POST /sdk/session troca a sua chave de API privada de lojista por um clientToken JWT de curta duração com um TTL de 30 minutos. Passe o clientToken ao navegador para inicializar new TheriusSDK({ clientToken }). A sua chave privada nunca chega ao navegador — ela fica no seu servidor, onde pertence.
O corpo da requisição é totalmente opcional — chame sem corpo para obter um clientToken simples. Defina country (obrigatório assim que você também definir amount, currency ou orderCode) para vincular a sessão e receber um sessionId. Veja os painéis de parâmetros e resposta acima para a lista completa de campos.
clientToken embute um hash HMAC-SHA256 da sua chave pública. A sua chave privada bruta nunca está presente na carga do token e nunca chega ao navegador.clientToken no lado do cliente.
Autorizações
Your secret API key: Bearer prv_production_xxx (production) or Bearer prv_sandbox_xxx (sandbox).
Corpo
ISO 3166-1 alpha-2 code of the shopper country. Optional for a bare clientToken; required if you also set amount, currency, or orderCode (those create a bound checkout session).
Locked amount in minor units. Omit to let the browser SDK manage the amount.
Locked ISO 4217 currency. Omit to let the browser SDK manage it.
Number of installments to offer. Defaults to 1.
Your order reference to attach to the resulting payment.
Your shopper identifier - enables saved-card retrieval and the save-card checkbox for this session.
Pre-assigned Therius payment code, if you allocate them yourself.
UUID of a Checkout Builder configuration to bind to this session.
Declares this session's checkout starts a stored-credential mandate (e.g. {"type": "recurring"} for a merchant-managed subscription you bill against yourself later). Requires customerId. When set, the Checkout Widget shows a fixed "card will be saved" disclosure instead of the optional save-card checkbox, and the server forces tokenization + this stored-credential tagging on the resulting charge regardless of what the browser sends. Omit for a plain checkout that just follows the Checkout Builder's save-card setting.
The payer's billing address, if you already know it. The Checkout Widget does not ask the shopper for fields you supply here, and a purchase that carries no address of its own is filled in from it. Boleto requires an address to register the voucher.
Shipping address, same shape as billingAddress. Filled into a purchase that carries none of its own. Requires country.
The payer's data, when you already know it. The Checkout Widget prefills (or, when the merchant chose 'Required, hidden if in session', skips) the matching fields and a purchase fills what it left blank from it. Defaults, not locks. Requires country.
Locks the order's line items for this session. A purchase made with the session token uses these and ignores any lineItems in the purchase call.
Locks the Level 2/3 card data for this session. A purchase made with the session token always uses it and ignores any commercialData in the purchase call, because that call can come from the browser. Requires country.
Resposta
SDK session token
Short-lived JWT for the browser SDK. Pass as Bearer to the SDK endpoints.
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Token lifetime in seconds.
1800
The merchant default Checkout Builder config, when no checkoutConfigId was supplied.
Checkout session ID - present when country created a session.
Echoed session country.
Echoed locked amount.
Echoed locked currency.
Echoed stored-credential intent, present only when the request set cardOnFile.
SRI hash of the latest SDK bundle served at GET /sdk/js, when available. Prefer the immutable release in sdk.
The current immutable SDK release. Render url and integrity into the page script tag (with crossorigin="anonymous") on every page render; the URL always serves exactly the bytes the hash describes. Absent when no release is available, in which case use GET /sdk/js without integrity.