Sessions Flow
Create a POST /sessions request on the server and pass only the returnedid and sessionData to Adyen Web. The final outcome is asynchronous and must be reconciled from the AUTHORISATION webhook.
With v6.41.0, card installments for Sessions belong in the request-levelinstallmentOptions. Checkout API v72 accepts an expiry up to 24 hours; the default session expiry is one hour.
Advanced Flow
The browser calls your backend for /paymentMethods, /paymentsand /payments/details. The component callback resolves with the backend response so Adyen Web can handle redirects, 3DS2 or QR/voucher actions.
Drop-in is the all-in-one surface; Components let you mount one payment method. Both have the same rule: API keys and merchant credentials stay server-side.
Frontend callbacks
Core callbacks include onSubmit, onAdditionalDetails,onPaymentCompleted, onPaymentFailed, onError,onChange and payment-method-specific events. This playground records chronological, sanitized snapshots. Encrypted fields, sessionData and card data are redacted.
Adyen Web 6.41.0 adds healthcare data to onBinLookup, validates an invalidthreeDSNotificationURL in challenge tokens, uses stricter TypeScript callback types, and fixes aria-checked whenopenFirstPaymentMethod=false.
Webhooks, HMAC & idempotency
Verify HMAC before business processing, store the event durably, acknowledge it, then apply idempotent state transitions. Standard webhooks sign a canonical colon-separated field list; newer webhook families can sign the unchanged raw body in headers.
Deduplication uses stable event identity, not arrival time. API mutations carry a UUID idempotency key capped at 64 characters. Late and out-of-order events update the same correlated aggregate.
Capture, cancellation & refund
Capture is possible only for authorised, uncaptured methods that support separate capture. Cancellation applies before capture; refund applies after capture. Disabled actions remain visible with a reason in the Back Office.
iDEAL and MB WAY do not support separate capture. They support refunds. PayPal is intentionally configured as settlement-only in this playground, even though other merchant configurations can support separate/partial capture.
Partial payments and multiple attempts
Checkout /orders combines tenders such as a gift card followed by card. A remaining amount of zero is not sufficient to close: wait for all payments to reach final status and for ORDER_CLOSED success=true. Expired or manually cancelled orders close with success=false.
Pay by Link
Links default to 24 hours and can be configured up to 70 days. Adyen expires a link after five unsuccessful attempts. Therefore REFUSED is attempt-level; the order can remain open until the effective link status becomes completed or expired.
MIT & tokenization
Create tokens only after shopper consent. Subsequent merchant-initiated requests usestoredPaymentMethodId, a non-PII shopperReference,shopperInteraction=ContAuth, and eitherSubscription or UnscheduledCardOnFile.
API Only & PCI
A custom form does not remove PCI obligations. Adyen Custom Card/Secured Fields keeps sensitive entry inside secure iframes and sends encrypted values. This server rejects raw PAN, CVC and security-code keys and never persists card payloads.
Troubleshooting
- 403 or component load errors: add the exact local/deployed origin to the TEST client key.
- Empty Drop-in: verify merchant payment methods, country, currency and client key.
- Webhook rejected: configure the endpoint-specific TEST HMAC key and do not reuse LIVE keys.
- Action disabled: inspect method capability, capture state and latest webhook in the timeline.
- 3DS redirect loops: verify returnUrl origin and preserve correlation without PII.