Developers › Get started

Quickstart

Take a test payment in about five minutes.

Verified 6 November 2026Explain this to your team →

1. Install the SDK

bash

npm install @secureprocessing/node

On Deno — including Supabase Edge Functions — import it directly. It has no dependencies and uses only fetch and Web Crypto, and its types come with it. Run with --allow-import=secureprocessing.app.

import { SecureProcessing } from "https://secureprocessing.app/sdk/0.2.6/index.js";

2. Create a payment

A payment intent tracks one payment from start to finish. The checkout session gives you a URL to send your customer to.

import { SecureProcessing } from "@secureprocessing/node";

const sp = new SecureProcessing(process.env.SECURE_PROCESSING_KEY!);

const intent = await sp.paymentIntents.create({
  amount: 6000,          // minor units — $60.00
  currency: "usd",
  description: "Order 1042",
  metadata: { order_id: "1042" },
});

const session = await sp.checkoutSessions.create({
  payment_intent: intent.id,
  success_url: "https://example.com/thanks",
  cancel_url: "https://example.com/cart",
});

// Send your customer to session.url

3. Pay with a test card

Open the URL and pay with 5555555555555599, expiry 12/34, CVC 123. The bank returns you to our result page, which confirms the payment and offers a Continue button to your success_url. The payment will be in your dashboard. To know which payment came back, put {CHECKOUT_SESSION_ID} in the success_url — see accept a payment.

4. Listen for the webhook

Do not treat the redirect as proof of payment — a customer can close the tab. The webhook is what tells you to fulfil the order. Register an endpoint first — in the dashboard under Developers → Webhooks, or with sp.webhookEndpoints.create — and store the signing secret it shows you, because it is shown only once. The webhooks page has the details.

const event = await sp.webhooks.constructEvent(
  rawBody,                                      // the RAW string, not a parsed object
  request.headers.get("Secure-Processing-Signature")!,
  process.env.SECURE_PROCESSING_WEBHOOK_SECRET!,
);

if (event.type === "payment_intent.succeeded") {
  // fulfil the order
}

Pass the raw body. JSON.stringify(JSON.parse(body)) produces different bytes, so the signature will not match — this is the most common reason a first webhook integration fails.

That is the whole flow

Everything else is a variation on it: hold now and charge later, refund all or part, save a card and charge it again. Each has its own page.