Checkout app
The standalone hosted checkout application for payment processing with Redis session persistence.
apps/checkout is the hosted payment application. After the storefront places an order, the customer is redirected here to complete payment via Stripe, Easypay, or Ifthenpay.
Port: 3004 · Framework: Next.js 16 · Database: None (Upstash Redis for sessions)
Architecture
Drag to pan · Scroll to zoom
Key dependencies
| Package | Role |
|---|---|
@prood/checkout-host | Session create/load/persist, webhook forwarding |
@prood/checkout | CheckoutSession state machine (used internally) |
@prood/types | Error response helpers |
@prood/ui | Button, skeleton, toast components |
@stripe/react-stripe-js | Stripe Payment Element |
Routes
| Route | Purpose |
|---|---|
/pay | Landing / entry page |
/pay/c/[id] | Payment UI |
/pay/confirm/[id] | Post-3DS / async confirmation |
The app is built with basePath: "/pay", so every route, asset and API call lives under /pay: https://prood.com/pay in production, http://localhost:3004/pay locally. The routes below are written relative to it.
See Sessions for API route details.
Configuration
| Variable | Required | Purpose |
|---|---|---|
KV_REST_API_URL | Yes | Redis REST endpoint |
KV_REST_API_TOKEN | Yes | Redis REST token |
CHECKOUT_API_SECRET | Yes | Protects session creation API |
CHECKOUT_URL | Yes | Public checkout base URL including its path, https://prood.com/pay |
COMMERCE_API_URL | Yes | Webhook forwarding target |
Security
- Session creation requires
x-checkout-secretheader — only trusted callers (storefront) can create sessions - Webhook routes are org-scoped:
/pay/api/webhooks/{provider}/{orgId} - Payment provider credentials loaded per tenant from encrypted integration config
- No direct database access — all order updates go through the Commerce API