OptionalapiPinned Checkout API version, e.g. "v72".
OptionalbaseOptionaldefaultWhere Adyen sends the shopper back from a redirect or a 3-D Secure
challenge. returnUrl is one of the required top-level fields on
POST /payments, so a session that carries none falls back to this value;
with neither, session creation is refused instead of sending Adyen a
request it rejects.
Explicit, never inferred. sandbox -> checkout-test.adyen.com, live -> {liveUrlPrefix}-checkout-live.adyenpayments.com.
OptionalfetchInjected for tests.
Optionalinit: RequestInitOptionalinit: RequestInitWebhook HMAC keys as generated in the Customer Area (HEX). Pass several to rotate with no cutover — any active key verifying wins.
OptionalliveThe account's live URL prefix — REQUIRED when environment is "live".
OptionalmaxAutomatic retries for transport-level trouble only (network failure, timeout, HTTP 5xx, 429) with exponential backoff. Default 2. Safe because every mutating call carries an idempotency key. Business errors (refusals, validation) are NEVER retried here.
The merchant account every request is booked against.
OptionalnowInjected clock (ms since epoch) — drives the session context expiry.
OptionalpaymentAccount capabilities vary by contract — override instead of trusting defaults.
OptionalrequestAbort a hung Adyen connection after this many milliseconds (default 30000).
The timer covers the whole exchange including the response body read. Every
call carries an idempotency-key, so a timed-out request is safe to retry.
Timeouts surface as retryable psp_unavailable.
HMAC key for the stateless signed session context (see session-context.ts).
OptionalsessionHow long a signed session context stays completable, in seconds. Default 3600 (1h). A signed token must not be valid forever — expiry is enforced at completePayment.
OptionalsleepInjected backoff sleep for retry tests; defaults to real setTimeout.
Basic-auth credentials configured on the Adyen webhook endpoint. Adyen's HMAC authenticates eight field values only, so the rest of a delivery is trusted on the strength of the channel it arrived on — verification requires these. Pass several to rotate with no cutover.
Checkout API key, sent as the
X-API-Keyheader. Server-side only.