Hosted checkout

<button id="register">Register</button>

<script>
  const LACES_BASE = "https://connect.laces.run/v1";
  // Publishable: safe in page source. Only works from your allowed domains.
  const LACES_PK = "LCSPUBK-ABCDEFGHJKLMNPQRSTUVWXYZ23456789-X";
  const EVENT_ID = "q3Zk9mVx";

  document.getElementById("register").addEventListener("click", async () => {
    const res = await fetch(`${LACES_BASE}/checkout-sessions`, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "X-Laces-Publishable-Key": LACES_PK,
      },
      body: JSON.stringify({
        event_id: EVENT_ID,
        on_success_url: "https://shop.example.com/thanks?session={CHECKOUT_SESSION_ID}",
        on_cancel_url: "https://shop.example.com/events/kampala-city-10k",
        client_reference_id: "cart-8841",
      }),
    });
    const body = await res.json();
    if (!res.ok) {
      showError(body.error_code); // see "Errors" below
      return;
    }
    window.location.assign(body.data.url);
  });
</script>

curl -s -X POST "$BASE/checkout-sessions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "event_id": "q3Zk9mVx",
    "on_success_url": "https://shop.example.com/thanks?session={CHECKOUT_SESSION_ID}",
    "on_cancel_url": "https://shop.example.com/events/kampala-city-10k",
    "client_reference_id": "cart-8841",
    "prefill": { "buyer_name": "Amina Nakato", "buyer_email": "amina@example.com" }
  }'

// GET /thanks?session=LCSCS-...
app.get("/thanks", async (req, res) => {
  const sessionId = String(req.query.session || "");
  const token = await getLacesToken(); // cached; see Authentication
  const r = await fetch(
    `${BASE}/checkout-sessions/${encodeURIComponent(sessionId)}`,
    { headers: { Authorization: `Bearer ${token}` } },
  );
  if (!r.ok) return res.status(400).send("We couldn't verify your payment.");
  const { data } = await r.json();

  const cart = await currentCart(req); // the buyer's cart, from your own session cookie
  if (!cart || data.client_reference_id !== cart.id) {
    return res.status(400).send("This payment doesn't belong to your cart.");
  }
  if (data.status !== "complete" || data.order?.status !== "paid") {
    return res.send("Your payment isn't complete yet. We'll email you when it is.");
  }
  await fulfil(cart, data.order); // idempotent: the webhook may get here first
  res.send(`You're registered. Order ${data.order.code}.`);
});

@app.get("/thanks")
def thanks():
    session_id = request.args.get("session", "")
    r = requests.get(
        f"{BASE}/checkout-sessions/{quote(session_id, safe='')}",
        headers={"Authorization": f"Bearer {get_laces_token()}"},
        timeout=30,
    )
    if not r.ok:
        return "We couldn't verify your payment.", 400
    data = r.json()["data"]

    cart = current_cart()  # the buyer's cart, from your own session cookie
    if not cart or data["client_reference_id"] != cart.id:
        return "This payment doesn't belong to your cart.", 400
    if data["status"] != "complete" or (data["order"] or {}).get("status") != "paid":
        return "Your payment isn't complete yet. We'll email you when it is."
    fulfil(cart, data["order"])  # idempotent
    return f"You're registered. Order {data['order']['code']}."