Libraries and SDKs
Cashonrails integrations should keep secret-key operations on your backend. Client-side libraries may help you launch checkout experiences, but transaction initialization, payout creation, verification, webhook handling, and reconciliation belong on your server.
Supported Paths
| Path | Use it for | Notes |
|---|---|---|
| Node.js backend | Server-side Merchant API calls, checkout initialization, verification, customer management, reserved accounts, payouts, and webhook processing. | Recommended for production integrations. |
| React frontend | Launching a checkout UI or using an access code created by your backend. | Do not expose secret keys in React, mobile, or browser code. |
Recommended Architecture
- Your backend creates the Cashonrails transaction or payout.
- Your frontend receives only non-secret values such as
authorization_url,access_code, or your own order reference. - Cashonrails redirects the customer or sends a webhook after processing.
- Your backend verifies final state with Cashonrails before fulfilling the order or marking a payout complete.
Security Rules
- Never put secret keys, encryption keys, webhook keys, or RSA private keys in frontend code.
- Use the production base URL
https://api.cashonrails.comand staging base URLhttps://mainapi.stag.cashonrails.com. - For encrypted businesses, encrypt backend request bodies as described in API Encryption.
- For payouts, configure RSA signing and send
X-SignatureplusIdempotency-Key.
Start with the Node.js backend guide for server-side flows, then use the React guide only for frontend checkout handoff.
Last updated on