OptionalbaseExplicit, never inferred. sandbox -> api-sandbox.gocardless.com, live -> api.gocardless.com.
OptionalexitWhere the hosted flow sends payers who cannot proceed (e.g. unsupported bank).
OptionalfallbackLets a billing request fall back from instant bank payment to collecting
a Direct Debit mandate: GoCardless offers the payer that option when they
cannot find their bank or their bank authorisation fails. Off by
default: fallback payments confirm on debit timing (days), not seconds.
Only true is sent; false leaves fallback_enabled unset, as GoCardless
asks when its payment intelligence feature is used ("Should not be set
if GoCardless payment intelligence feature is used"). Leave it unset with
Protect+ and Verified Mandates too: "Fallbacks should not be used if you
are using Protect+ with Verified Mandates."
OptionalfetchInjected for tests.
Optionalinit: RequestInitOptionalinit: RequestInitOptionalgoPinned GoCardless-Version request header, overridable when GoCardless dates a new one.
OptionalmaxAutomatic retries for transport-level trouble only (network failure, timeout, HTTP 5xx, 429) with exponential backoff. Default 2. Safe for mutating calls: a retried create carries the same Idempotency-Key and resolves to the resource GoCardless already created, a retried cancel that finds the resource cancelled is resolved by re-reading it, and a retried flow create only issues another authorisation URL for the same billing request. Business errors (validation, invalid_state, permissions) are NEVER retried here.
OptionalpaymentThe methods a session declares. Override only to narrow the defaults (to
what your account enables): every session is a one-off Pay by Bank
payment, so declaring sepa_debit or bacs_debit supported would not
make one collect by Direct Debit.
OptionalrequestAbort a hung GoCardless connection after this many milliseconds (default 30000; GoCardless's own server-side limit is 29s). The timer covers the whole exchange including the response body read. Timed-out requests are safe to retry (see maxNetworkRetries) and surface as retryable psp_unavailable errors.
OptionalsleepInjected backoff sleep for retry tests; defaults to real setTimeout.
Webhook endpoint secret(s) from the dashboard. Accepts several at once so a rotation needs no cutover — any active secret verifying wins.
Read-write access token from the GoCardless dashboard (server-side only).