> ## Documentation Index
> Fetch the complete documentation index at: https://docs.skinloop.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a hosted checkout

> Create a server-side checkout session and receive its hosted URL.

## Purpose and prerequisites

`POST /v1/merchant-api/checkouts` creates a hosted customer session. Use a
server-side key with `checkout:create`, the API URL copied from the dashboard,
and success/cancellation URLs whose origins are registered for your merchant.
Only USD is supported. Amounts are integer cents (`4999` means `$49.99`).

## Request

The merchant is derived from the API key and cannot be overridden. Include an
`Idempotency-Key` of 16–255 allowed characters and a unique value per order
attempt. The one API-key record may permit `cs2`, `rust`, or both; every
`allowedGames` value must be within that key's permissions.

```bash theme={null}
curl --fail-with-body "$SKINLOOP_API_BASE_URL/v1/merchant-api/checkouts" \
  -H "Authorization: Bearer $SKINLOOP_API_KEY" \
  -H "Idempotency-Key: order_123_attempt_1" \
  -H "Content-Type: application/json" \
  -d '{
    "merchantOrderId": "order_123",
    "amount": {"value": 4999, "currency": "USD"},
    "allowedGames": ["cs2"],
    "successUrl": "https://YOUR_REGISTERED_ORIGIN.example/paid",
    "cancelUrl": "https://YOUR_REGISTERED_ORIGIN.example/canceled",
    "metadata": {"cart": "cart_123"},
    "expiresInSeconds": 3600
  }'
```

## Result

`201` creates a session; `200` is an identical idempotent replay. Save `id` and
redirect to `hostedUrl`. The response includes `status`, `expiresAt`, and any
merchant `warnings`, plus `reservationRequired`, `fulfillmentAllowed`, and
`holdUntil`. A CS2 checkout has `reservationRequired: true`: once hold begins,
the CS2 trade is held for eight days and `holdUntil` is authoritative. Keep the
merchant order reserved and finalize only after `payment.completed`.
`allowedGames` accepts `cs2`, `rust`, or both; Rust-only checkouts do not have
the eight-day reservation policy.

**Next:** redirect the customer, then confirm status rather than trusting the
redirect.