​

Checkout from your server

• The buyer cannot change the products, plans or quantities. Changing a line from the checkout page is refused with lines_locked.
• The buyer cannot change the email you set. The checkout page shows it read-only. The other details you send stay the buyer’s to correct, such as a postal code.
• Your metadata and external_reference cannot be changed from the checkout page, and arrive on the order’s webhooks as order.metadata.
• Redirect URLs must be registered. A success_url or cancel_url that is not one of your registered redirect URLs is refused with invalid_redirect_url rather than ignored.

​

Create the checkout

curl https://api.cope.com/v1/commerce/checkouts \
  -H "Authorization: Bearer $COPE_SECRET_KEY" \
  -H "Idempotency-Key: booking-4711-checkout" \
  -H "Content-Type: application/json" \
  -d '{
    "external_reference": "booking-4711",
    "currency": "EUR",
    "lines": [{ "product_id": "prod_...", "plan_id": "plan_...", "quantity": 1 }],
    "buyer_identity": { "email": "buyer@example.com", "country": "DE", "postal_code": "10115" },
    "metadata": { "crm_deal": "4711" },
    "checkout": { "success_url": "https://your-site.example/thank-you" }
  }'

{
  "data": {
    "object": "checkout",
    "id": "chk_A1b2C3d4E5f6G7h8",
    "status": "open",
    "checkout_url": "https://app.cope.com/checkout/...",
    "external_reference": "booking-4711",
    "metadata": { "crm_deal": "4711" },
    "buyer_email_locked": true,
    "totals": { "currency": "EUR", "subtotal_minor_units": 4999, "tax_minor_units": 950, "total_minor_units": 5949 },
    "order": null
  }
}

• Idempotency-Key is required. A repeat with the same key answers with the same checkout.
• Ids are COPE’s public ids. A line’s plan_id is the plan’s plan_ id from payment_plans[].uuid; an integer is refused with validation_error.
• metadata is yours. external_reference, intended_payment_method and the keys COPE reserves for itself are refused inside it with reserved_metadata_key.
• A member the operation does not take is refused with invalid_request (400). A checkout created from your server does not take buyer consents: the buyer gives them on the checkout page.

​

Confirm the order by the checkout’s id

{ "data": { "object": "checkout", "id": "chk_A1b2C3d4E5f6G7h8", "status": "completed", "order": { "object": "order", "id": "ord_..." } } }