Hosted Checkout#

Create a checkout session from your server and send the shopper to a payment page hosted by AuxCORE — full page, or embedded in an iframe on your site. Card data never reaches your servers. The WooCommerce plugin is built on this flow.

How it works#

1. Your server creates a session with POST /api/v1/public/checkout-session and your secret key. The response holds a redirectUrl and an iframeUrl.
2. The shopper pays on the hosted page — send them to redirectUrl, or load iframeUrl in an iframe.
3. AuxCORE returns the shopper to your returnUrl, declineUrl or cancelUrl — or to its own outcome page if you gave none, or they are not on your registered store URL.
4. Your server fulfils the order from the webhook, not from the return redirect: transaction.approved carries your orderId. session.cancelled and session.expired tell you the shopper did not pay.

The session lasts 10 minutes by default. After that the shopper cannot pay on it; create a new one.

curl -X POST https://uat.auxcore.net/api/v1/public/checkout-session \
  -H "x-api-key: YOUR_SECRET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 49.90,
    "orderId": "ORD-1042",
    "description": "Order #1042",
    "customerEmail": "jane@example.com",
    "customerName": "Jane Doe",
    "billingAddress": {
      "line1": "123 Main St",
      "city": "Austin",
      "state": "TX",
      "postalCode": "78701",
      "country": "US"
    },
    "returnUrl": "https://shop.example.com/orders/1042/thanks",
    "declineUrl": "https://shop.example.com/orders/1042/payment-failed",
    "cancelUrl": "https://shop.example.com/cart"
  }'

{
  "success": true,
  "status": "success",
  "data": {
    "sessionId": "cs_4f1d0c6b2a9e8d7c6b5a4f3e2d1c0b9a",
    "refNo": "AUX-20261008-9f3a1c2e",
    "iframeUrl": "https://uat.auxcore.net/iframe?cs=cs_4f1d0c6b2a9e8d7c6b5a4f3e2d1c0b9a",
    "redirectUrl": "https://uat.auxcore.net/vt?cs=cs_4f1d0c6b2a9e8d7c6b5a4f3e2d1c0b9a",
    "expiresAt": "2026-10-08T09:24:00.000Z",
    "metadata": null,
    "merchantLogo": null,
    "merchantName": "Acme Coffee",
    "redirectUrls": {
      "success": "https://shop.example.com/orders/1042/thanks",
      "decline": "https://shop.example.com/orders/1042/payment-failed",
      "cancel": "https://shop.example.com/cart"
    }
  }
}

Redirects and embedding#

Both depend on the merchant's registered store URL — the store origin saved with the merchant's WooCommerce settings in the dashboard (Merchant setup).

• Redirects: returnUrl, declineUrl and cancelUrl are honoured only on that origin. Any other URL is dropped (it shows as null in redirectUrls) and the shopper lands on AuxCORE's outcome page instead.
• Embedding: the page may be framed by that origin and by the Allowed origins of the API key that created the session. Anywhere else the browser refuses the iframe — use redirectUrl instead.

Without a registered store URL, sessions still work as full-page checkouts; only merchant redirects and iframe embedding are unavailable.

Confirm the payment#

Never treat the return redirect as proof of payment — a shopper can open a return URL directly. Confirm on your server:

1. Webhooks (recommended). Subscribe to the default events with POST /register-webhook. Match data.orderId on transaction.approved, transaction.declined and transaction.in_review (hold the order until it is approved). session.cancelled and session.expired carry the sessionId and orderId of a session that was not paid.
2. Lookup (fallback). If no webhook arrives within a few seconds, look the payment up with GET /api/v1/public/transaction-list?orderId=… (Transactions).

Next steps#

• Webhook Events →
• Refunds →
• WooCommerce Plugin →