Skip to main content

Endpoint

Authentication

Use your secret key in the Authorization header:

Request Body

Item structure

Every field of an item is required. Omitting one returns 422 with field: "items.*.<name>".

Example Request

Response

201 Created

The session is returned as a checkout.session object, with snake_case field names.
This endpoint does not return orderId, expiresAt, createdAt or updatedAt, and the identifier is prefixed cs_ — not session_. Code that reads those camelCase fields gets undefined, and code that filters on a session_ prefix matches nothing. Read id, url and expires_at instead.

422 Unprocessable Entity

Validation failures return 422 — not 400. Each entry names the failing field and the rule that rejected it; field uses items.*.<name> for a field inside an item.

401 Unauthorized

A missing Authorization header returns a plain-text body (content-type: text/plain):
An invalid or expired key returns JSON: