Embedded checkout

Keep checkout on your website

The widget now opens delivery details, saved partner branding, quality warnings and image-rights confirmation inside your current page. Uploading cards does not navigate customers to the TCGPlaytest website. Only the payment step opens Stripe; verified payment then returns to your registered success URL.

The registered website is allowed to embed checkout automatically. Add additional exact HTTPS origins under Dashboard → Widget websites. These embedding permissions do not change the separate origin restriction on return_url. No new API key, database migration or environment variable is needed.

For a server API integration, keep creating and polling carts on your server. Load the widget script with data-auto-button="false" and the configured data-checkout-origin, then pass the open cart to the browser helper:

// Run after the widget script loads. cart comes from your own server.
// Never send the partner API secret to the browser.
if (cart.status === "open") TCGPlaytest.checkout(cart);
// Do not navigate window.location to cart.checkout_url for this flow.

The helper validates the checkout URL and opens a protected frame on the partner page. Closing it keeps the submitted cart available to resume. Test carts show an Open simulated checkout button that opens a full-page sandbox. For an intentional full-page handoff, add data-checkout-display="redirect" to the script; embedded checkout is the default.

Existing API clients that explicitly redirect to checkout_url must replace that redirect with the helper above. The API cannot control navigation already performed by a partner's browser code.

If checkout is blocked

Test previews do not exercise the live checkout frame. Save the exact HTTPS origin of the page opening checkout under Dashboard → Widget websites; www.example.com and example.com are different origins. Use a fresh live cart whose status is open. An expired, already-used or unvalidated cart cannot open checkout.

Use the helper above instead of framing the raw checkout_url. The helper opens /embed/partner-checkout/<token>?parent_origin=<origin>. Ordinary checkout pages intentionally send X-Frame-Options: DENY. Embedded checkout checks the cart and saved origins before allowing the frame; Stripe payment still opens at the top level.

If it still fails, open browser DevTools → Network, select the failed embed document and copy only its X-TCGP-Checkout-Request-Id response header. Send support that reference, the time and your website origin. Do not post the private checkout URL, cookies, tokens or API keys. Support can match the reference to the specific rejection reason in both applications' logs. If the header is absent, report that too; an older deployment or a hosting/firewall response may have handled the request.