One checkout, seven ways to open it.

Libraries for your server, a button for any web page, and SDKs for React Native, iOS, Android and Flutter. Install one from npm, Packagist, Swift Package Manager, Maven Central or pub.dev, try it against your sandbox keys, and take a live payment the day you are approved. New to it? Start with the developer guide.

How every SDK works

1
Your server creates the checkout
With your secret key, for an amount it takes from your own records. Apps and web pages never hold a key and never set the price.
2
The customer pays on the hosted checkout
By redirect on the web, from the pay button, or in the system browser sheet in an app. Card details go to Payable's payment page and nowhere else.
3
Your server confirms
From the signed payment.succeeded webhook, or by reading the checkout. The customer's return carries checkout and status, which is enough to show a screen but never proof of payment.

Server

Node.js

Checkouts with an amount or line items, payments, refunds, payment links, saved cards, the event log and your account, with webhook verification, retries and idempotency keys built in. Webhook events are typed by their type. No dependencies.

Requires: Node.js 18.17 or later
Package: @payments-lk/node 0.4.1

View on npm Source on GitHub

What changed in each version

No registry access? Download it instead

payments-lk-node-0.4.1.tgz 281 KB

SHA-256 e31e774d95850a3bba1f7734af4a28861370c09a7e650712eca1f4411fffe61e

Install

npm install @payments-lk/node

Take a payment and confirm it

import { PaymentsLk } from "@payments-lk/node";

const lk = new PaymentsLk(process.env.PAYMENTS_LK_SECRET_KEY);

// Create the checkout, then send the customer to checkout.url
const checkout = await lk.checkouts.create(
  {
    amountCents: 145000,
    description: "Chicken kottu",
    reference: "order-8891",
    successUrl: "https://yourshop.lk/thanks",
    cancelUrl: "https://yourshop.lk/cart",
  },
  { idempotencyKey: "order-8891" },
);

// In your webhook route, with the raw body
const event = lk.webhooks.constructEvent(rawBody, req.headers["payments-signature"], process.env.PAYMENTS_LK_WEBHOOK_SECRET);
if (event.type === "payment.succeeded") fulfil(event.data);

Server

PHP

The same API for PHP, events and your account included, with the same retries, idempotency keys and webhook verification. It needs only curl and json, so it runs on shared hosting.

Requires: PHP 8.1 or later, ext-curl, ext-json
Package: payments-lk/payments-lk-php 0.4.1

View on Packagist Source on GitHub

What changed in each version

No registry access? Download it instead

payments-lk-php-0.4.1.zip 211 KB

SHA-256 edab0c9050a3859fe332a9125bcd7c2ffdca6349194b4d3c412d974019863da2

Install

composer require payments-lk/payments-lk-php

Take a payment and confirm it

$payments = new PaymentsLk\Client(getenv('PAYMENTS_LK_SECRET_KEY'));

$checkout = $payments->checkouts->create([
    'amountCents' => 145000,
    'description' => 'Chicken kottu',
    'reference' => 'order-8891',
    'successUrl' => 'https://yourshop.lk/thanks',
    'cancelUrl' => 'https://yourshop.lk/cart',
], ['idempotencyKey' => 'order-8891']);
header('Location: ' . $checkout['url'], true, 303);

// webhook.php
$event = PaymentsLk\Webhook::constructEvent(
    file_get_contents('php://input'),
    $_SERVER['HTTP_PAYMENTS_SIGNATURE'] ?? null,
    getenv('PAYMENTS_LK_WEBHOOK_SECRET'),
);

Web page

Pay button

One script tag turns any button into a checkout. A click asks your own server for a checkout, then sends the customer to it. Your key never reaches the browser.

Requires: Any page, plus one endpoint on your server

SHA-256: bfcad3ba41dd76d8af0ea1cd287ecc9c429fb9edb50b5f8b77e3b8764055d18a

Download pay.js11 KB

On your page

<button data-payments-lk-checkout="/create-checkout"
        data-payments-lk-body='{"sku":"kottu"}'
        data-payments-lk-error-target="#pay-error">
  Pay Rs. 1,450
</button>
<p id="pay-error" role="alert"></p>

<script src="https://payments.lk/js/pay.js" defer></script>

On your server

// Your endpoint prices the order from your own records, never from the browser
app.post("/create-checkout", express.json(), async (req, res) => {
  const item = catalogue[req.body.sku];
  if (!item) return res.status(400).json({ message: "That item is not for sale." });
  const checkout = await lk.checkouts.create({
    amountCents: item.cents,
    description: item.name,
    successUrl: "https://yourshop.lk/thanks",
    cancelUrl: "https://yourshop.lk/menu",
  });
  res.json({ url: checkout.url });
});

App

React Native

Opens the checkout in an authentication sheet and brings the outcome back to your app through its own URL scheme. Works with Expo and bare React Native.

Requires: React Native 0.72 or later; expo-web-browser recommended
Package: @payments-lk/react-native 0.1.1

View on npm Source on GitHub

What changed in each version

No registry access? Download it instead

payments-lk-react-native-0.1.1.tgz 56 KB

SHA-256 60d73180787bbf4c5fe6fb8c462fcf3b3d5ca51f8170d1364b5e3706e6d95d8e

Install

npm install @payments-lk/react-native
npx expo install expo-web-browser

Open the checkout

import * as WebBrowser from "expo-web-browser";
import { openCheckout } from "@payments-lk/react-native";

// Your server creates the checkout with successUrl and cancelUrl set to
// myshop://payments-lk/return, and answers with its id and url.
const checkout = await api.post("/app/checkouts", { orderId });

const result = await openCheckout({
  checkoutUrl: checkout.url,
  returnUrl: "myshop://payments-lk/return",
  browser: WebBrowser,
});
// result.status: succeeded, failed, canceled, expired or dismissed.
// Show it, then ask your server, which confirms with the API.

App

iOS

A Swift package built on ASWebAuthenticationSession: the system's own secure browser sheet, which closes itself when the checkout returns to your app.

Requires: iOS 15 or later, Xcode 15 or later
Package: PaymentsLk 0.1.2

Open on GitHub

What changed in each version

No registry access? Download it instead

payments-lk-ios-0.1.2.zip 43 KB

SHA-256 c39e7aa10f4e484b850476b837a061f10ab1ef19dcad9b6795643bc669aa089d

Install

// Xcode: File > Add Package Dependencies, enter the address below,
// then add the PaymentsLk library to your app target.
https://github.com/PAYable-IPG/payments-lk-ios

// Or in Package.swift:
.package(url: "https://github.com/PAYable-IPG/payments-lk-ios.git", from: "0.1.2")

// Or with CocoaPods, in the Podfile:
pod 'PaymentsLk', '~> 0.1'

Open the checkout

import PaymentsLk

let checkout = PaymentsLkCheckout()

// created.url comes from your server, which set successUrl and
// cancelUrl to myshop://payments-lk/return
let result = try await checkout.present(
    checkoutURL: created.url,
    callbackScheme: "myshop"
)

switch result.status {
case .succeeded: showConfirming()   // then confirm on your server
case .failed: showDeclined()
case .canceled, .expired, .dismissed: showNotCompleted()
}

App

Android

A Kotlin library built on Custom Tabs, with a launcher that reports the outcome from the redirect, or tells you the customer closed the tab.

Requires: Android 6.0 (API 23) or later, compileSdk 36
Package: lk.payments:payments-lk-android 0.1.1

View on Maven Central Source on GitHub

What changed in each version

No registry access? Download it instead

payments-lk-android-0.1.1.zip 108 KB

SHA-256 1a8212941368b966032a6dbe8a14af63a155b4dd10478d833176f0c9cea86d8c

Install

// app/build.gradle.kts; mavenCentral() is already in settings.gradle.kts
dependencies {
    implementation("lk.payments:payments-lk-android:0.1.1")
}

Open the checkout

// AndroidManifest.xml: the activity is singleTop, with an intent filter
// for android:scheme="myshop" android:host="payments-lk"

class CheckoutActivity : AppCompatActivity() {
    private val launcher = CheckoutLauncher(returnScheme = "myshop")

    private fun pay(checkoutUrl: String) = launcher.launch(this, checkoutUrl)

    override fun onNewIntent(intent: Intent) {
        super.onNewIntent(intent)
        launcher.handleRedirect(intent)?.let(::show)
    }

    override fun onResume() {
        super.onResume()
        launcher.onResume()?.let(::show) // DISMISSED if the tab was closed
    }
}

App

Flutter

Opens the checkout in the system's own secure browser, an authentication sheet on iOS and a Custom Tab on Android, and brings the outcome back to your app through its own URL scheme.

Requires: Flutter 3.24 or later, on iOS and Android
Package: payments_lk 0.1.0

View on pub.dev Source on GitHub

What changed in each version

No registry access? Download it instead

payments-lk-flutter-0.1.0.zip 39 KB

SHA-256 dc0dd9406f8c344fa3091923a52bdaee6511c21e5db320e22f36e26ca2087b30

Install

flutter pub add payments_lk

<!-- Android only: android/app/src/main/AndroidManifest.xml, in <application> -->
<activity
    android:name="com.linusu.flutter_web_auth_2.CallbackActivity"
    android:exported="true"
    android:taskAffinity="">
    <intent-filter android:label="flutter_web_auth_2">
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:scheme="myshop" />
    </intent-filter>
</activity>

Open the checkout

import 'package:payments_lk/payments_lk.dart';

// Your server creates the checkout with successUrl and cancelUrl set to
// myshop://payments-lk/return, and answers with its id and url.
final result = await PaymentsLkCheckout().open(
  checkoutUrl: created.url,
  callbackScheme: 'myshop',
);
// result.status: succeeded, failed, canceled, expired or dismissed.
// Show it, then ask your server, which confirms with the API.

Check what you install

Every SDK has a public repository on GitHub, where you can read the code, see what changed in each version and open an issue. Each version is built, tested and published there by GitHub Actions. The npm packages carry provenance, which ties each version to the commit and the workflow that built it, and the Android library is signed, which Maven Central checks before it accepts a version.

The files on this page are the same code, for a machine without registry access. Compare a file’s SHA-256 with the one beside it before you use it.

# after npm install: check the packages' provenance
npm audit signatures

# a file from this page
shasum -a 256 payments-lk-node-0.4.1.tgz

One checkout, seven ways to open it.

How every SDK works

Your server creates the checkout

The customer pays on the hosted checkout

Your server confirms

Node.js

Install

Take a payment and confirm it

PHP

Install

Take a payment and confirm it

Pay button

On your page

On your server

React Native

Install

Open the checkout

iOS

Install

Open the checkout

Android

Install

Open the checkout

Flutter

Install

Open the checkout

Check what you install