Skip to main content

Overview

The JavaScript SDK lets you collect card payments inside your own web checkout. Customers stay on your site, and the card details are entered into secure Modulus-hosted fields that your page never touches. An integration has two pieces:

Payment Intents API

A server-side REST call that represents an amount the customer has agreed to pay. Your backend creates the intent with your secret key.

JavaScript SDK

A browser library that renders the card fields, runs 3D Secure, and confirms the payment with your publishable key.
Card data is entered into Modulus-hosted iframes. It never enters your frontend code or DOM.

End to end

How it works

1

Create a Payment Intent (server)

When the customer reaches checkout, your server calls Create a Payment Intent with the amount and currency, using your secret key. You receive an id and a client_secret.
2

Hand the intent to the browser

Pass the id and client_secret to your checkout page. Your server never sees card data from here on.
3

Mount the card fields

Load the SDK, initialize it with your publishable key, and mount the secure card fields into your checkout layout.
4

Confirm the payment

Call confirmPayment. The SDK collects the card securely, runs 3D Secure if the bank requires it, and resolves with the final result.

Prerequisites

You are provisioned two keys at onboarding, with separate sandbox and live sets:

What is client_secret?

When your server creates a Payment Intent, the API returns a client_secret alongside the intent id. The client_secret is a one-time token that ties your publishable key to that specific intent. Without it, a pk_ key alone cannot read or confirm any payment. Your server passes the client_secret to the browser at checkout; the SDK sends it back to Modulus when the customer submits, proving that this browser session is authorized to act on that intent. Never log it, never reuse it across intents, and never expose it outside the checkout page that needs it.

Base URLs

This documentation targets the sandbox environment. Use keys provisioned for sandbox; no real money is moved. See Testing for the sandbox card numbers. Amounts are integers in the currency’s smallest unit (for PHP, centavos).