Checkout

Reference pages: Payment Options, Generate Payment, Hosted Payment Page options, Hosted Fields JSAPI Guide, Pay Sale.

Choose

	Hosted page	Hosted Fields	Saved token
Card typed in	PayMe's page, in an iframe or a redirect	PayMe's iframes, in your form	Nowhere
Buyer present	Yes	Yes	No
Calls	`generate-sale`	`generate-sale`, browser `tokenize`, `pay-sale`	`generate-sale` with the token

Default to the hosted page. Add Hosted Fields only when the checkout must look native. Use a token only when no buyer is present (TOK-03 covers raw cards).

Every flow

Create the sale on your server. A partner uses the seller's MPL: the partner's own MPL fails with error 174. Amounts follow Money.
Send your order ID as transaction_id, and store payme_sale_id against the order (SAL-02).
Keep one open sale per order (SAL-01). failed isn't final. After a decline the sale is failed, but the same sale_url still opens, and a good card then completes it. Send the buyer back to that page, don't open a second one, and keep re-reading the sale. Create a new sale only once the previous one is voided or canceled, or its sale_expiry_seconds has passed.
Take a callback or a return page only as a signal to check. Fulfil after a query confirms it (CB-01, CB-09).

Limiting a payment page

sale_expiry_seconds closes the page. In the sandbox, a page with sale_expiry_seconds: 5 answered HTTP 403 after 7 seconds, and a failed sale's page closed the same way once its time passed. Paying an expired sale fails with error 367. Set it when you create the sale: it's the only way to close an ordinary open page.
An ordinary open sale has no cancel call. cancel-template is for template sales only, and a void needs an authorized sale.
sale_should_be_opened_once applies to pages that capture a card without charging it. An ordinary sale page still opened twice in the sandbox, so don't rely on it there.

Hosted page

Show sale_url in an iframe, or redirect to it. If your site sets a Content Security Policy, its frame-src must allow that address.
Pre-filling fields and iframe redirects are on Hosted Payment Page options.
On an Israeli card, a Social ID field replaces Zip Code as soon as the card number is typed. When automating a test, fill whichever of the two is showing.
browser/hosted-page.html in the integration kit is a complete example.

Hosted Fields

PayMe.create takes the seller's public key, never an MPL or a partner key.
One instance gets one tokenize(). After any failure, clear the containers and start again with a new sale and a new instance. A new sale is safe here because your server makes the payment call and the buyer never saw the first sale's sale_url. The Hosted Fields JSAPI Guide has the full list.
Handle pay-sale by status_code: 0 means processed, so record sale_status and confirm it; 5 means send the buyer to redirect_url; anything else means start again with a new sale.
Ask PayMe whether you need 3DS with Hosted Fields.
browser/hosted-fields.js in the integration kit is a working module.

Saved token

See Saved Cards. Never repeat a token charge whose outcome is unknown before checking the sale (TRN-04).