Online checkout quickstart
Take a card-not-present payment in five steps. You'll need a kepa account, a publishable key, and ten minutes. No terminal.
sk_test_ secret key and run on your server. Steps 3 and 4 use your pk_kepa_publishable key and run in the customer's browser. The secret key must never cross that line — see Authentication.Create a payment intent
On your server, with your secret key. A payment intent is the record of what you intend to charge — amount, currency, merchant. It comes back with a clientSecret scoped to this one payment.
Open a checkout session
Still server-side. The session is what the browser actually completes, and carries the URLs to return the customer to. Keep the id and clientSecret — the browser needs both, and nothing else.
Mount the payment form
Load kepa.js and initialise it with your publishable key. Drop-in renders the card fields, and the card input is a kepa-hosted iframe — raw card numbers never enter your page, which is what keeps you out of PCI scope.
Confirm
Hand confirm() the session id and client secret from step 2. Frictionless 3DS runs automatically. When your account has a live 3DS provider, issuer challenges use the same confirmation flow. Apple Pay and Google Pay remain preview capabilities until enabled for your account.
Fulfil on the webhook
The browser tells you the customer finished; the webhook tells you the money moved. Ship goods on the webhook, never on the browser callback — a closed tab or a hostile client should not decide that.
- Drop-in & Elements → appearance, wallet buttons, and the full browser SDK.
- 3DS → when you need to drive the challenge yourself.
- Test cards → sandbox PANs and the amounts that force a decline.