Checkout snippet

Status. The snippet and its immutable asset host are planned (build tracks to FR-12/FR-13). The contract below is what will ship; version and SRI hashes are published here as assets land.

The checkout snippet is the zero-API integration path: one <script> tag brings digid pay Secure Fields onto your page, captures the card, tokenizes it inside the digid pay tokenization vault, and confirms the PaymentIntent — all in your branding.

Immutable, versioned, SRI-pinned

The snippet is served from a dedicated asset host under a fixed filename per build with a published integrity hash:

<script
  src="https://assets.digid.cc/checkout.v1.js"
  integrity="sha384-<published-hash>"
  crossorigin="anonymous"
></script>

• A published version is never mutated in place. Upgrades ship as a new version you opt into.
• Assets are served with Cache-Control: immutable.
• If the served bytes do not match the SRI hash, the browser fails closed — there is no silent downgrade path.

You can also load it without a pinned version for convenience, but pinning the integrity hash is strongly recommended (it is what the script-integrity evidence trail expects).

Initialise

The snippet exposes a global once loaded:

const checkout = await digidPay.checkout({
  publishableKey: 'pk_sandbox_...',       // sandbox or live
  clientSecret: 'pi_..._secret_...',       // server-provided, bound to the intent
  onEvent: handleEvent,
})

checkout.mount('#digid-checkout')

Option	Required	Purpose
publishableKey	yes	Identifies your account + mode (client-safe).
clientSecret	yes	Binds this checkout to one PaymentIntent; the only secret the browser ever holds.
onEvent	yes	Callback contract (below).
paymentMethods	no	Restrict card brands (subset for Secure Fields).
style	no	Field styling tokens (see Secure Fields).

PaymentIntent lifecycle driven by the snippet

1. Your server creates a PaymentIntent (requires_payment_method) and passes client_secret to the page.
2. digidPay.checkout({...}) renders Secure Fields into the mount node.
3. On submit, the card is captured inside the vault iframes, tokenized, and the snippet confirms the PaymentIntent (payment_intent.succeeded on success, requires_action handled inline for SCA).
4. Your server fulfils on the webhook — never on a client callback alone.

Callback contract

onEvent(event) fires on the merchant-relevant transitions:

Event	Meaning
ready	Fields mounted and interactive.
change	Field state changed ({complete, empty, brand}).
payment_intent.processing	Confirmed; authorising.
payment_intent.requires_action	SCA challenge in progress (handled in-frame; see SCA).
payment_intent.succeeded	Authorised and captured.
payment_intent.payment_failed	Declined — surface the error and allow retry.

function handleEvent(event) {
  switch (event.type) {
    case 'payment_intent.succeeded':
      // show success; server will also get the webhook
      break
    case 'payment_intent.payment_failed':
      // event.error.code / event.error.message
      break
  }
}

Where digid pay shows up

Your shoppers interact with your page; the card-entry iframes are digid pay Secure Fields under the hood with a minimal, merchant-controllable digid pay presence. The code is integrity-governed, not chrome-governed — you keep the look.

Loading considerations

• Load the snippet from the asset host directly (do not self-host a copy — the SRI pin assumes the canonical bytes).
• If the snippet fails the integrity check the page should degrade to your existing fallback; do not attempt to load an unpinned copy silently.

Related

• Secure Fields — the styling guide underneath.
• Quickstart — the snippet path end to end.